Function at 0x14003dfc0
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc90]
sub rsp, 0xd90
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0xc80], rax
mov rbx, rcx
mov qword [rbp + 0x20], rcx
xor r13d, r13d
mov qword [rcx + 0x2e8], r13
mov qword [rcx + 0x2f0], r13
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003e053
lea rdx, str.InjectTouchInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2e8], rax
lea rdx, str.InitializeTouchInjection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2f0], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [rbx + 0x2c8]
mov rdx, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_connected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140017a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x28], r13
mov rcx, qword [rbx + 0x2c8]
mov rdx, qword [rcx + 0x4f8]
mov rcx, qword [rbx + 0x2c0]
mov r8, qword [rcx]
call qword [r8 + 0x1e0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x40]
test al, al
je 0x14003e207
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x14003e236
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], r13b
je 0x14003e207
cmp byte [0x1401f32c3], r13b
jne 0x14003e207
mov rdx, qword [rbx + 0x2c0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
test ecx, ecx
jle 0x14003e162
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0xa8], 0
jne 0x140042d46
inc r13d
mov rdx, qword [rbx + 0x2c0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
cmp r13d, ecx
jl 0x14003e130
add dword [rdx + 0xb8], 0xa
mov rax, qword [rbx + 0x2c0]
cmp dword [rax + 0xb8], 0x14
jle 0x14003e183
mov dword [rax + 0xb8], setsockopt
lea r8, str.vncClientThread::run_:_PostAddNewClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov r8, qword [rcx]
mov rax, qword [rbx + 0x2c8]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0xac]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xb0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x1af]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140020d80
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
jmp 0x140042d46
mov rax, qword [rbx + 0x2c0]
mov dword [rax + 0xb8], r13d
lea r8, str.vncClientThread::run_:_negotiated_version_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x14003e2b3
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
cmp byte [0x1401f32c3], r13b
jne 0x140042d46
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], r13b
jmp 0x140042cbc
mov rdx, qword [rbx + 0x2c8]
cmp byte [rdx + 0x10c], r13b
jne 0x14003e2e1
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov rdx, qword [rdx + 0x4f8]
call qword [rax + 0x1e8]
mov rdx, qword [rbx + 0x2c8]
mov byte [rdx + 0x10c], r13b
mov rax, qword [0x1401fdf60]
imul edx, dword [rax + 0x758], 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.140087770
lea r8, str.vncClientThread::run_:_authenticated_connection_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov rcx, qword [rbx + 0x2c8]
call qword [rdi + 0x108]
mov rax, qword [rbx + 0x2c0]
mov rcx, qword [rbx + 0x2c8]
cmp qword [rax + 0x138], 1
ja 0x14003e39e
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [0x1401fdf60]
mov r8, qword [rbx + 0x2c8]
mov edx, dword [rcx + 0x7a0]
mov rcx, qword [r8 + 0x4b0]
call fcn.140034c10
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003e3f2
mov rax, qword [rax + 0x108]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xd8]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rbx + 0x2c0]
mov rdx, qword [rax + 0x108]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xd0]
mov rcx, qword [rbx + 0x2c8]
lea rdx, [rbp + 0x80]
mov rcx, qword [rcx + 0x4b0]
call fcn.140034ca0
mov rcx, qword [rbx + 0x2c8]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x840], xmm0
mov rdx, qword [rbx + 0x2c8]
mov rax, qword [rdx + 0x4b0]
mov ecx, dword [rax + 0x14]
mov dword [rdx + 0x850], ecx
mov dword [rbp - 0x4c], 0x130
xor edx, edx
mov r8d, 0x132
lea rcx, [rbp + 0x400]
call fcn.140133cd0
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rsi, 0xffffffffffffffff
mov r14d, 0x100
lea rcx, [rbp + 0x400]
test eax, eax
je 0x14003e4da
mov rdi, r13
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14003e480
test rax, rax
je 0x14003e4bf
nop
movsx ecx, byte [rbp + rdi + 0x400]
call fcn.140149734
mov byte [rbp + rdi + 0x400], al
inc rdi
lea rcx, [rbp + 0x400]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003e4b1
cmp rdi, rax
jb 0x14003e490
mov edx, 0x2e
lea rcx, [rbp + 0x400]
call fcn.14014a6b8
test rax, rax
je 0x14003e4eb
jmp 0x14003e568
lea r8, [0x1401c9afc]
mov edx, 0x132
call fcn.140139ff0
mov edx, r14d
lea rcx, [rbp + 0x2f0]
call fcn.14003d900
lea rcx, [rbp + 0x2f0]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003e504
cmp rax, 3
jbe 0x14003e568
movzx eax, byte [rbp + 0x2f0]
sub al, 0x48
cmp al, 1
jbe 0x14003e568
lea r8, [0x1401c9b04]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013a050
lea r8, [rbp + 0x2f0]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013a050
lea r8, [0x1401c9b08]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013a050
lea r8, [0x1401c9b0c]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013a050
mov rax, qword [0x1401fdf60]
lea rcx, str.application_mode
lea r8, str.service_mode
cmp dword [rax + 0xe20], 0
cmove r8, rcx
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.14013a050
mov r8, qword [rbx + 0x2c8]
mov rax, qword [r8 + 0x4b0]
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0x23c], xmm0
mov ecx, dword [r8 + 0x848]
mov eax, dword [r8 + 0x840]
mov edx, ecx
sub edx, eax
sar edx, 8
mov r9d, 0xff
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x238], dx
mov ecx, dword [r8 + 0x84c]
mov eax, dword [r8 + 0x844]
mov edx, ecx
sub edx, eax
sar edx, 8
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x23a], dx
movq rax, xmm0
shr rax, 0x20
rol ax, 8
mov word [rbp + 0x240], ax
rol word [rbp + 0x242], 8
rol word [rbp + 0x244], 8
lea rax, [rbp + 0x400]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003e660
mov eax, edi
bswap eax
mov dword [rbp + 0x24c], eax
mov r8d, 0x18
lea rdx, [rbp + 0x238]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087cf0
test eax, eax
je 0x14003e207
mov r8d, edi
lea rdx, [rbp + 0x400]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
test eax, eax
je 0x14003e207
lea r8, str.vncClientThread::run_:_sent_pixel_format_to_client_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x840
lea rcx, [rbp - 0x78]
call fcn.140025560
nop
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x70]
call fcn.140137f30
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 2
mov rcx, rbx
call fcn.140124ac0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 1
mov rax, qword [0x1401fdf60]
mov eax, dword [rax + 0x77c]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x50], 1
xor r15b, r15b
mov byte [rsp + 0x46], r15b
xor al, al
mov byte [rsp + 0x41], al
xor dil, dil
mov byte [rsp + 0x44], dil
mov byte [rsp + 0x51], 1
xor r12b, r12b
mov byte [rsp + 0x42], r12b
xor r14b, r14b
mov byte [rsp + 0x45], r14b
xor sil, sil
mov byte [rsp + 0x43], sil
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x118], al
je 0x140042a10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], eax
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test al, al
jne 0x14003e814
call fcn.1400209d0
test eax, eax
jne 0x14003e814
lea r8, str.vncClientThread::run_:_vncClientThread__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.140020ca0
test eax, eax
je 0x140042a10
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3c9], 0
je 0x14003e846
cmp byte [rsp + 0x50], 0
je 0x14003e846
mov cl, setsockopt
call fcn.14003d880
mov cl, 0x91
call fcn.14003d880
xor al, al
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 0x2c8]
cmp dword [rsp + 0x68], 0
je 0x14003e86c
mov rcx, qword [rcx + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004eef0
mov dword [rsp + 0x68], r13d
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x4b0]
movzx edx, byte [rsp + 0x51]
mov rcx, qword [rcx + 0x90]
call fcn.14004f820
mov byte [rsp + 0x51], 0
test r15b, r15b
mov r15d, 2
je 0x14003e8c4
mov rax, qword [0x1401fdf60]
mov r8d, dword [rax + 0x118]
mov edx, r15d
mov rcx, qword [rbx + 0x2c8]
call fcn.140047c50
mov dl, 1
mov rcx, qword [rbx + 0x2c8]
call fcn.140047cc0
mov byte [rsp + 0x46], 0
cmp byte [rsp + 0x41], 0
je 0x14003e8df
mov dl, 1
mov rcx, qword [rbx + 0x2c8]
call fcn.140047cc0
xor al, al
mov byte [rsp + 0x41], al
test dil, dil
je 0x14003e908
mov rax, qword [0x1401fdf60]
mov r8d, dword [rax + 0x11c]
mov edx, 3
mov rcx, qword [rbx + 0x2c8]
call fcn.140047c50
mov byte [rsp + 0x44], 0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x378], 0
je 0x14003e941
cmp byte [rax + 0x9ca], 0
je 0x14003e941
mov byte [rax + 0x378], 0
mov rcx, qword [rbx + 0x2c8]
mov r8d, dword [rcx + 0x374]
mov edx, dword [rcx + 0x370]
call fcn.140047c50
test r12b, r12b
je 0x14003e957
mov rcx, qword [rbx + 0x2c8]
call fcn.140047d80
mov byte [rsp + 0x42], 0
test r14b, r14b
je 0x14003e96d
mov rcx, qword [rbx + 0x2c8]
call fcn.140047dd0
mov byte [rsp + 0x45], 0
test sil, sil
je 0x14003e983
mov rcx, qword [rbx + 0x2c8]
call fcn.140047ef0
mov byte [rsp + 0x43], 0
mov r12d, 1
mov edi, r12d
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x31], 0
jne 0x14003e9d8
cmp byte [rax + 0x30], 0
je 0x14003e9d8
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x210]
cmp byte [rax + 0x39], 0
je 0x14003e9d8
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140042a02
mov edi, r13d
jmp 0x14003e9f6
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140042a02
movzx eax, byte [rbp + 0x140]
cmp eax, 0xfd
ja case.0x14003ea21.1
lea rsi, [0x140000000]
movzx eax, byte [rsi + rax + 0x42dd4]
mov ecx, dword [rsi + rax*4 + 0x42d90]
add rcx, rsi
jmp rcx
mov byte [rsp + 0x41], r12b
jmp 0x1400402e9
mov r8d, setsockopt
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x1400402e2
rol word [rbp + 0x148], 8
rol word [rbp + 0x14a], 8
rol word [rbp + 0x14c], 8
mov edx, r13d
cmp byte [rbp + 0x151], r12b
sete dl
mov rcx, qword [rax + 0x4b0]
mov dword [rcx + 0x9c], edx
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
lea rdx, [rbp + 0x144]
call fcn.140037e70
test eax, eax
jne 0x14003eae0
lea r8, str.vncClientThread::run_:_remote_pixel_format_invalid_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x5a8], r12d
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
jmp 0x1400402e9
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
mov rcx, qword [rbx + 0x2c8]
mov dword [rcx + 0x4a0], r13d
xor edx, edx
mov rcx, qword [rcx + 0x4b0]
call fcn.140036ba0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x48c], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x490], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x494], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x498], r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
mov rdi, 0xffffffffffffffff
mov edx, edi
call fcn.140038070
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x478], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ebb8
mov dword [rcx + 0x7c], edi
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x470], 6
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ebdc
mov dword [rcx + 0x74], 6
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x480], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ebfd
mov dword [rcx + 0x84], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ec1e
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ec4d
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
rol word [rbp + 0x142], 8
mov esi, r13d
mov r15d, r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x20]
mov r14d, r13d
cmp r13w, word [rbp + 0x142]
jae 0x14003f35c
nop dword [rax]
mov dword [rsp + 0x48], r13d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x14003f346
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov r8d, edi
and r8d, 0xff00
mov ecx, edi
shl ecx, 0x10
or ecx, r8d
shl ecx, 8
or ecx, edx
cmp ecx, 1
jne 0x14003ed51
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x540
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x20]
jmp 0x14003f331
cmp ecx, 0xffffff21
jne 0x14003ed6c
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x648], r12d
jmp 0x14003f331
cmp ecx, 0xfffffecc
jne 0x14003ed87
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x64c], r12d
jmp 0x14003f331
cmp ecx, 0xffff0001
jne 0x14003edc9
mov rcx, qword [rbx + 0x2c8]
mov dword [rcx + 0x4a0], r12d
mov edx, r12d
mov rcx, qword [rcx + 0x4b0]
call fcn.140036ba0
lea r8, str.vncClientThread::run_:_Cache_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
jmp 0x14003f331
cmp ecx, 0xffff000b
jne 0x14003ede8
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x48c], r12d
lea r8, str.vncClientThread::run_:_XOR_protocol_extension_enabled_n
jmp 0x14003edb3
lea eax, [rcx + 0x100]
cmp eax, 9
ja 0x14003ee56
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x100]
mov rax, qword [rbx + 0x2c8]
mov ecx, 6
cmp r9d, 9
cmovbe ecx, r9d
mov dword [rax + 0x470], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003ee39
mov eax, 6
cmp ecx, 9
cmovbe eax, ecx
mov dword [rdx + 0x74], eax
lea r8, str.vncClientThread::run_:_compression_level_requested:__d_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
jmp 0x14003f331
cmp ecx, 0xffffffe0
jb 0x14003ee92
cmp ecx, 0xffffffe9
ja 0x14003f20e
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
lea edx, [rdi + 0x20]
call fcn.140038070
lea r9d, [rdi + 0x20]
lea r8, str.vncClientThread::run_:_image_quality_level_requested:__d_n
jmp 0x14003ee40
cmp ecx, 0xfffffe00
jb 0x14003f056
cmp ecx, 0xfffffe64
ja 0x14003eef9
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x200]
mov rax, qword [rbx + 0x2c8]
mov rdi, 0xffffffffffffffff
mov ecx, edi
cmp r9d, 0x64
cmovbe ecx, r9d
mov dword [rax + 0x478], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14003eeed
mov eax, edi
cmp ecx, 0x64
cmovbe eax, ecx
mov dword [rdx + 0x7c], eax
lea r8, str.vncClientThread::run_:_fine_grained_image_quality_level_requested:__d_n
jmp 0x14003ee40
cmp ecx, 0xffffff20
jne 0x14003ef2e
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x480], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ef22
mov dword [rcx + 0x84], r12d
lea r8, str.vncClientThread::run_:_LastRect_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffffff10
jne 0x14003efb1
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x484], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003ef57
mov dword [rcx + 0x88], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_X_style_cursor_shape_updates_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffffff11
jne 0x14003f034
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003efda
mov dword [rcx + 0x8c], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffffff18
jne 0x14003f0a9
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r12d
lea r8, str.vncClientThread::run_:_PointerPos_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xfffffd00
jb 0x14003f0a9
cmp ecx, 0xfffffd05
ja 0x14003f20e
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
add edi, 0x300
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x47c], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f09a
mov dword [rcx + 0x80], edi
mov r9d, edi
lea r8, str.vncClientThread::run_:_subsampling_requested:__d_n
jmp 0x14003ee40
cmp ecx, 0xffff8000
jne 0x14003f0d9
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c8], 1
mov rax, qword [0x1401fdf60]
mov byte [rax + 0xe1c], 1
lea r8, str.vncClientThread::run_:_ServerState_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffff8003
jne 0x14003f0fb
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9cc], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffff8001
jne 0x14003f130
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9cb], 1
mov rax, qword [0x1401fdf60]
mov byte [rax + 0xe1d], 1
mov byte [rsp + 0x46], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffff8004
jne 0x14003f149
mov byte [rsp + 0x44], 1
lea r8, str.vncClientThread::run_:_IdleTime_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xffff8002
jne 0x14003f179
mov byte [rsp + 0x42], 1
lea r8, str.vncClientThread::run_:_FTProtocolVersion_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r12d, 1
jmp 0x14003f331
cmp ecx, 0xc0a1e5ce
jne 0x14003f1a0
mov byte [rsp + 0x45], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x5b0], 1
lea r8, str.vncClientThread::run_:_Extended_clipboard_protocol_extension_enabled_n
jmp 0x14003edb3
cmp ecx, 0xc0a1e5cf
jne 0x14003f1b9
mov byte [rsp + 0x43], 1
lea r8, str.vncClientThread::run_:_Streaming_DSM_support_enabled_n
jmp 0x14003edb3
cmp ecx, 0xfffffecf
jne 0x14003f1e1
lea r8, str.vncClientThread::run_:_Gii_Encoding_found_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r15d, r12d
jmp 0x14003f331
cmp ecx, 0x10
jne 0x14003f20e
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x490], r12d
lea r8, str.vncClientThread::run_:_ZRLE_found__n
lea edx, [rcx - 7]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov ecx, edi
shl ecx, 0x10
mov eax, edi
and eax, 0xff00
or ecx, eax
shl ecx, 8
or edx, ecx
cmp edx, 0x12
jne 0x14003f262
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x494], r12d
lea r8, str.vncClientThread::run_:_XZ_found__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov edi, dword [rsp + 0x48]
mov ecx, edi
and ecx, 0xff0000
mov eax, edi
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shl eax, 8
or ecx, eax
cmp ecx, 7
jne 0x14003f2af
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x498], r12d
lea r8, str.vncClientThread::run_:_Tight_found_n
lea edx, [rcx + 2]
lea rcx, vtable.VNCLog.0
call fcn.140017a50
test esi, esi
jne 0x14003f331
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 0x55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, dword [rsp + 0x48]
mov edx, r8d
and edx, 0xff0000
mov ecx, r8d
shr ecx, 0x10
or edx, ecx
shr edx, 8
mov eax, r8d
shl eax, 0x10
and r8d, 0xff00
or eax, r8d
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
xor r8d, r8d
call fcn.140036fb0
test eax, eax
cmovne esi, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc r14d
movzx eax, word [rbp + 0x142]
cmp r14d, eax
jl 0x14003ece0
jmp 0x14003f354
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
test esi, esi
jne 0x14003f3e7
lea r8, str.vncClientThread::run_:_defaulting_to_raw_encoder_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
xor r8d, r8d
xor edx, edx
call fcn.140036fb0
test eax, eax
jne 0x14003f3de
lea r8, str.vncClientThread::run_:_failed_to_select_raw_encoder__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x2c8]
cmp dword [rax + 0x670], 0
jne 0x14003f48e
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f415
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14003f444
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp eax, 1
jbe 0x14003f4b0
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x228]
test r15d, r15d
je 0x14003f4e1
cmp qword [rbx + 0x2e8], 0
je 0x14003f4e1
cmp qword [rbx + 0x2f0], 0
je 0x14003f4e1
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3cb], 0
je 0x14003f4e1
mov rcx, rbx
call fcn.14003a9c0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x3a8], r12d
jmp 0x14003eaee
mov byte [rsp + 0x40], 0
mov word [rsp + 0x4c], r13w
xor sil, sil
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x308
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x14003f56e
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_subtype_failed___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400402e9
mov r8d, r15d
lea rdx, [rsp + 0x4c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x14003f58f
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_length_failed___n
jmp 0x14003f543
movzx edx, byte [rsp + 0x40]
movzx r8d, word [rsp + 0x4c]
test dl, dl
jns 0x14003f5b3
mov sil, 1
rol r8w, 8
mov word [rsp + 0x4c], r8w
and dl, 0x7f
mov byte [rsp + 0x40], dl
movzx r9d, dl
mov ecx, r9d
test dl, dl
je 0x14003fc18
sub ecx, 1
je 0x14003fb5f
sub ecx, 1
je 0x14003f657
cmp ecx, 1
je 0x14003f601
lea r8, str.vncClientThread::run_:_GII:_Extension_invalid_subtype:__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
mov rax, qword [rbx + 0x2c8]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], dl
jne 0x14003f638
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3cb], 0
jne 0x14003f68f
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1bc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1cc], xmm1
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1ec], r13
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x309
lea rcx, [rbp + 0x48]
call fcn.140019e70
nop
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIDeviceCreation__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov byte [rbp + 0x1b8], 0xfd
movzx eax, byte [rsp + 0x40]
mov byte [rbp + 0x1b9], al
movzx eax, word [rsp + 0x4c]
mov word [rbp + 0x1ba], ax
mov r8d, gethostname
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x14003f751
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
lea rcx, [rbp + 0x48]
call fcn.140019ea0
jmp 0x14004027f
test sil, sil
je 0x14003f884
mov ecx, dword [rbp + 0x1e0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e0], edx
mov ecx, dword [rbp + 0x1e4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e4], edx
mov ecx, dword [rbp + 0x1e8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e8], edx
mov ecx, dword [rbp + 0x1ec]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x1ec], r8d
mov ecx, dword [rbp + 0x1f0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1f0], edx
mov ecx, dword [rbp + 0x1dc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
bswap edx
mov dword [rbp + 0x1dc], edx
jmp 0x14003f88b
mov r8d, dword [rbp + 0x1ec]
lea eax, [r8 - 1]
cmp eax, 9
ja 0x14003fb53
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], eax
mov edi, r13d
test r8d, r8d
je 0x14003f743
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, [rbp + 0x250]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x14003fb47
test sil, sil
je 0x14003faba
mov ecx, dword [rbp + 0x250]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x250], edx
mov ecx, dword [rbp + 0x2a4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a4], edx
mov ecx, dword [rbp + 0x2a8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a8], edx
mov ecx, dword [rbp + 0x2ac]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2ac], edx
mov ecx, dword [rbp + 0x2b0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b0], edx
mov ecx, dword [rbp + 0x2b4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b4], edx
mov ecx, dword [rbp + 0x2b8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b8], edx
mov ecx, dword [rbp + 0x2bc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2bc], edx
mov ecx, dword [rbp + 0x2c0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2c0], edx
mov dword [rbp - 0x80], 0x40082fd
mov dword [rbp - 0x7c], 0x1000000
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r8d, 8
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087cf0
test eax, eax
je 0x14003fb3b
mov edx, r12d
mov ecx, dword [rbp + 0x1f0]
call qword [rbx + 0x2f0]
mov ecx, dword [rbp + 0x1f0]
mov dword [rbx + 0x300], ecx
lea eax, [rcx - 1]
cmp eax, 0xfc
ja 0x14003fb28
call fcn.14013134c
mov qword [rbx + 0x2f8], rax
inc edi
cmp edi, dword [rbp + 0x1ec]
jb 0x14003f8e0
jmp 0x14003f743
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
jmp 0x14003f727
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation_valuators_failed_n
jmp 0x14003f727
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation__invalid_amount_of_valuators_n
jmp 0x14003f727
mov rax, qword [rbx + 0x2c8]
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], 0
je 0x1400429d8
mov word [rsp + 0x54], r13w
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIVersionMessage__n
mov edx, 9
call fcn.140017a50
cmp word [rsp + 0x4c], 2
je 0x14003fbab
movzx r9d, word [rsp + 0x54]
lea r8, str.vncClientThread::run_:_GII:Extension_invalid_length:__d_n
jmp 0x14003f5e0
mov r8d, r15d
lea rdx, [rsp + 0x54]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x14003fbeb
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_version_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
movzx eax, word [rsp + 0x54]
test sil, sil
je 0x14003fbfe
rol ax, 8
mov word [rsp + 0x54], ax
cmp ax, 1
je 0x14004027f
movzx r9d, ax
lea r8, str.vncClientThread::run_:_GII:_Extension_client_version_invalid_number:__d_n
jmp 0x14003f5e0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3cb], 0
jne 0x14003fc50
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
jmp 0x14004027f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov byte [rbp + 0x188], 0xfd
mov byte [rbp + 0x189], dl
mov word [rbp + 0x18a], r8w
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x18c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x14003fc96
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
jmp 0x14003fc2f
test sil, sil
je 0x14003fd3f
rol word [rbp + 0x18e], 8
mov ecx, dword [rbp + 0x190]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x190], edx
mov ecx, dword [rbp + 0x194]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x194], r8d
mov ecx, dword [rbp + 0x198]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x198], edx
jmp 0x14003fd46
mov r8d, dword [rbp + 0x194]
mov ecx, r8d
mov eax, 0x20
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14013134c
mov r15, rax
mov r14d, r13d
cmp dword [rbp + 0x194], r13d
jbe 0x140040151
lea r12d, [rdi + 5]
nop dword [rax + rax]
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x78], r13d
mov qword [rbp + 0x168], r13
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
test sil, sil
je 0x14003fdf2
mov ecx, dword [rsp + 0x48]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x48], edx
mov r8d, r12d
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
test sil, sil
je 0x14003fe41
mov ecx, dword [rsp + 0x58]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x58], edx
jmp 0x14003fe45
mov edx, dword [rsp + 0x58]
mov edi, r14d
shl rdi, 5
add rdi, r15
mov dword [rdi], edx
mov r8d, r12d
lea rdx, [rsp + 0x5c]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
test sil, sil
je 0x14003fea0
mov ecx, dword [rsp + 0x5c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x5c], edx
jmp 0x14003fea4
mov edx, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x48]
test r9b, 0x10
je 0x14004011e
mov eax, edx
shr eax, 0x10
mov dword [rdi + 0xc], eax
movzx eax, dx
mov dword [rdi + 0x10], eax
bt r9d, 0x1c
jae 0x14003ff33
mov r8d, r12d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
test sil, sil
je 0x14003ff22
mov ecx, dword [rsp + 0x60]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x60], edx
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x14003ff39
mov edx, dword [rsp + 0x60]
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x14003ff39
mov eax, r12d
mov edx, r12d
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], eax
bt r9d, 0x19
jae 0x14003ff67
mov r8d, r12d
lea rdx, [rsp + 0x64]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x14003ff98
mov ecx, dword [rsp + 0x64]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x64], edx
bt r9d, 0x18
jae 0x14003ffc0
mov r8d, r12d
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x14003fff1
mov ecx, dword [rsp + 0x78]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x78], edx
bt r9d, 0x17
jae 0x14004001e
mov r8d, 8
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140040127
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x1400400b8
mov rdx, qword [rbp + 0x168]
mov r8, rdx
movabs rax, 0xff000000000000
and r8, rax
mov rax, rdx
shr rax, 0x10
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff0000000000
and rax, rcx
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff00000000
and rax, rcx
or r8, rax
shr r8, 8
mov rcx, rdx
shl rcx, 0x10
mov rax, rdx
and eax, 0xff00
or rcx, rax
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
mov eax, 0xff000000
and rdx, rax
or rcx, rdx
shl rcx, 8
or r8, rcx
mov qword [rbp + 0x168], r8
mov dword [rdi + 4], r13d
mov eax, dword [rdi]
cmp eax, dword [rbx + 0x300]
jae 0x140040109
mov ecx, eax
test r9d, r9d
jns 0x1400400f7
mov rax, qword [rbx + 0x2f8]
cmp byte [rcx + rax], 1
jne 0x1400400e3
mov dword [rdi + 4], 0x20006
jmp 0x140040109
mov dword [rdi + 4], 0x10006
mov rax, qword [rbx + 0x2f8]
mov byte [rcx + rax], 1
jmp 0x140040109
mov dword [rdi + 4], 0x40000
mov rax, qword [rbx + 0x2f8]
mov byte [rcx + rax], 0
mov dword [rdi + 0x1c], r13d
inc r14d
cmp r14d, dword [rbp + 0x194]
jae 0x14004014a
jmp 0x14003fd80
lea r8, str.vncClientThread::run_:_Only_16bit_XT_supported_n
jmp 0x14004012e
lea r8, str.vncClientThread::run_:_GIIExtension_reading_TouchINfo_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rdi, 0xffffffffffffffff
mov eax, dword [rbp + 0x194]
cmp eax, 0xfe
ja 0x140040276
mov ecx, eax
mov eax, 0x90
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14013134c
mov rsi, rax
mov ecx, dword [rbp + 0x194]
lea r8, [rcx + rcx*8]
shl r8, 4
xor edx, edx
mov rcx, rax
call fcn.140133cd0
mov edi, r13d
mov ecx, dword [rbp + 0x194]
test ecx, ecx
je 0x140040265
mov ebx, 7
lea r14d, [rbx - 5]
nop dword [rax]
mov ecx, edi
lea r11, [rcx + rcx*8]
shl r11, 4
add r11, rsi
mov dword [r11], r14d
shl rcx, 5
lea r10, [rcx + r15]
mov r9d, dword [r10 + 0xc]
mov dword [r11 + 0x20], r9d
mov r8d, dword [r10 + 0x10]
mov dword [r11 + 0x24], r8d
mov eax, dword [r10 + 0x1c]
mov dword [r11 + 0x40], eax
mov dword [r11 + 0x60], r13d
mov dword [r11 + 0x64], ebx
mov dword [r11 + 0x88], 0x5a
mov dword [r11 + 0x8c], 0x7d00
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ecx, r8d
sub ecx, eax
mov dword [r11 + 0x6c], ecx
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, r8d
mov dword [r11 + 0x74], eax
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
mov ecx, r9d
sub ecx, eax
mov dword [r11 + 0x68], ecx
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, r9d
mov dword [r11 + 0x70], eax
mov eax, dword [r10]
mov dword [r11 + 4], eax
mov eax, dword [r10 + 4]
mov dword [r11 + 0xc], eax
inc edi
mov ecx, dword [rbp + 0x194]
cmp edi, ecx
jb 0x1400401b0
mov rbx, qword [rbp + 0x20]
mov rdx, rsi
call qword [rbx + 0x2e8]
mov rcx, rsi
call fcn.140131300
mov rcx, r15
call fcn.140131300
nop
lea rcx, [rbp - 0x20]
call fcn.140019ea0
jmp 0x1400402e9
mov r8d, 0xa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
movsd xmm0, qword [rbp + 0x140]
movsd qword [rbp - 0x10], xmm0
movzx eax, word [rbp + 0x148]
mov word [rbp - 8], ax
lea rdx, [rbp - 0x10]
mov rcx, qword [rbx + 0x2c8]
call fcn.140043ea0
test al, al
jne 0x1400402e9
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rcx, qword [0x1401fdf60]
call fcn.140038970
test eax, eax
je 0x140040305
mov rcx, qword [rbx + 0x2c8]
call fcn.140047b30
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x118], 0
je 0x140042a10
movzx r12d, byte [rsp + 0x42]
movzx esi, byte [rsp + 0x43]
movzx edi, byte [rsp + 0x44]
movzx r14d, byte [rsp + 0x45]
movzx r15d, byte [rsp + 0x46]
jmp 0x14003e7c4
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x1400404e7
cmp byte [0x1401f2eba], 0
je 0x140040479
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x144], edx
cmp byte [rbp + 0x141], 0
je 0x1400404e7
lea r8d, [rdx - 0x61]
cmp r8d, 0x63
ja 0x1400404e7
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov rdx, qword [rcx + 0x90]
movsxd rax, r8d
imul rcx, rax, 0x64
mov rax, qword [rdx + 0xe440]
mov ecx, dword [rcx + rax]
mov dword [0x1401f2ebc], ecx
lea r8, str.GlobalSessionEventUltraPreConnect
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rsi, rax
lea r8, str.GlobalSessionUltraPreConnect
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x14004044d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140040444
mov ecx, dword [0x1401f2ebc]
mov dword [rax], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400404e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2c8]
call fcn.140046760
jmp 0x1400402e9
mov r8, qword [rbx + 0x2c8]
cmp byte [r8 + 0x3c9], 0
je 0x1400404e7
mov edx, dword [rbp + 0x144]
mov ecx, edx
and ecx, 0xff0000
mov eax, edx
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shl eax, 8
or ecx, eax
mov dword [rbp + 0x144], ecx
cmp byte [rbp + 0x141], 0
setne dl
movzx r9d, byte [r8 + 0x3cd]
movzx r8d, byte [r8 + 0x3cc]
call fcn.140075a00
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x5ac], r12d
mov rcx, qword [rbx + 0x2c8]
call fcn.140046760
jmp 0x1400402e9
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x1400402e9
cmp byte [0x1401f2eba], 0
jne 0x1400402e9
mov r8, qword [rbx + 0x2c8]
cmp byte [r8 + 0x3ca], 0
je 0x1400402e9
movzx eax, word [rbp + 0x142]
rol ax, 8
mov word [rbp + 0x142], ax
movzx ecx, word [rbp + 0x144]
rol cx, 8
mov word [rbp + 0x144], cx
movzx eax, ax
movzx edx, word [r8 + 0x850]
imul edx, eax
mov word [rbp + 0x142], dx
movzx eax, word [r8 + 0x850]
movzx r9d, cx
imul r9d, eax
mov word [rbp + 0x144], r9w
mov r14d, 0x8000
cmp dx, word [r8 + 0x536]
jne 0x1400405ae
cmp r9w, word [r8 + 0x538]
je 0x1400405b4
mov r14d, 0x8001
movzx ecx, byte [rbp + 0x141]
movzx eax, cl
xor al, byte [r8 + 0x535]
test r12b, al
je 0x1400405fe
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movzx ecx, byte [rbp + 0x141]
test eax, eax
movzx eax, cl
not al
je 0x1400405f1
and eax, r12d
lea eax, [rax*8 + 8]
jmp 0x1400405fb
and eax, r12d
lea eax, [rax*2 + 2]
or r14d, eax
mov rax, qword [rbx + 0x2c8]
movzx r8d, byte [rax + 0x535]
movzx edx, cl
and dl, 2
movzx eax, r8b
and al, 2
cmp dl, al
je 0x14004062f
mov eax, 0x40
test dl, dl
mov edx, 0x20
cmovne eax, edx
or r14d, eax
xor r8b, cl
test r8b, 4
je 0x140040677
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 4
test eax, eax
je 0x14004065e
test byte [rbp + 0x141], dil
mov eax, edi
cmovne eax, r15d
or r14d, eax
jmp 0x14004067c
test byte [rbp + 0x141], 4
mov eax, reloc.WS2_32.dll_recv
mov ecx, 8
cmovne eax, ecx
or r14d, eax
jmp 0x14004067c
mov edi, 4
mov rcx, qword [0x1401fdf60]
call fcn.140038980
test eax, eax
je 0x140040795
mov rcx, qword [rbx + 0x2c8]
movzx edx, byte [rcx + 0x535]
movzx eax, dl
movzx r8d, byte [rbp + 0x141]
xor al, r8b
test r12b, al
jne 0x1400406b9
xor dl, r8b
test dl, 2
je 0x1400406e0
cmp byte [rcx + 0x3b8], 0
jne 0x140040795
mov byte [rcx + 0x3ad], r12b
mov rcx, qword [rbx + 0x2c0]
call fcn.140085a70
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3b8], 0
jne 0x140040795
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, dword [rdi + 0x38c]
add r14d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r14d, ecx
sub r14d, eax
mov rcx, qword [0x1401fdf60]
call fcn.1400389b0
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x140040776
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r14d, word [rbp + 0x144]
add r14d, dword [rax + 0x384]
mov rcx, qword [rax + 0x3c0]
test rcx, rcx
je 0x1400402e9
mov r8d, r14d
mov edx, esi
call fcn.1400238e0
jmp 0x1400402e9
mov r12d, r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x3e0
call fcn.140038100
movzx ecx, byte [rbp + 0x141]
test eax, eax
je 0x1400407e3
mov rax, qword [rbx + 0x2c8]
test cl, 8
je 0x1400407d3
test byte [rax + 0x535], 8
jne 0x1400407d3
mov r12d, 0x78
jmp 0x140040803
test cl, 0x10
je 0x140040808
test byte [rax + 0x535], 0x10
jne 0x140040808
jmp 0x1400407fd
movzx eax, cl
and al, 8
je 0x1400407ef
bts r14d, 0xb
neg al
sbb r12d, r12d
and r12d, 0x78
test cl, 0x10
je 0x140040808
mov r12d, 0xffffff88
bts r14d, 0xb
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x48]
call qword [rax + 0x1c0]
mov r8, qword [rbx + 0x2c8]
cmp dword [r8 + 0x390], 0
je 0x1400408aa
movzx eax, word [rbp + 0x142]
mov ecx, dword [r8 + 0x380]
add ecx, eax
imul eax, ecx, 0xffff
mov ecx, dword [rbp - 0x48]
dec ecx
cdq
idiv ecx
mov esi, eax
movzx ecx, word [rbp + 0x144]
mov edx, dword [r8 + 0x384]
add edx, ecx
imul eax, edx, 0xffff
mov r8d, dword [rbp - 0x68]
dec r8d
cdq
idiv r8d
mov edi, eax
mov rcx, qword [rbx + 0x2c0]
call fcn.1400849e0
neg eax
sbb rdx, rdx
and edx, 0x564e4300
mov qword [rsp + 0x20], rdx
mov r9d, r12d
mov r8d, edi
mov edx, esi
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x140040adf
lea rcx, [r8 + 0x998]
call fcn.140029900
test al, al
je 0x1400409e4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
mov rdi, qword [rbx + 0x2c8]
lea ecx, [rax + 0x4c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2c8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, dword [rdi + 0x38c]
add r15d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r15d, ecx
sub r15d, eax
mov rcx, qword [0x1401fdf60]
call fcn.1400389b0
test eax, eax
je 0x140040956
mov rax, qword [rbx + 0x2c8]
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r15d, word [rbp + 0x144]
add r15d, dword [rax + 0x384]
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, esi, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x60], eax
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, r15d, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x64], eax
bts r14d, 0xe
mov dword [rbp + 0x6c], r14d
mov rcx, qword [rbx + 0x2c0]
call fcn.1400849e0
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x68], r12d
mov dword [rbp + 0x70], r13d
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x998
call fcn.140048990
mov r8d, 0x28
lea rdx, [rbp + 0x58]
mov r12d, 1
mov ecx, r12d
call rax
jmp 0x140040ae5
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6c], r13d
mov dword [rbp - 0x64], 0xa
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov dword [rbp + 0x2e8], eax
test r14b, 1
je 0x140040a74
btr r14d, 0xf
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x70]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov qword [rbp + 0x2d0], 0xa
mov dword [rbp + 0x2d8], r13d
xor r9d, r9d
lea r8, [rbp - 0x64]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rbp + 0x2d0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov rcx, qword [rbx + 0x2c0]
call fcn.1400849e0
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
movzx r8d, word [rbp + 0x144]
sub r8d, dword [rbp - 0x2c]
movzx edx, word [rbp + 0x142]
sub edx, dword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
test r14b, 1
je 0x140040adf
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r12d, 1
mov rcx, qword [rbx + 0x2c8]
mov eax, dword [rbp + 0x140]
mov dword [rcx + 0x534], eax
movzx eax, word [rbp + 0x144]
mov word [rcx + 0x538], ax
jmp 0x1400404d9
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x1400402e9
mov ecx, dword [rbp + 0x144]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x6400000
jg 0x1400402e9
test edi, edi
jns 0x140040cb9
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x5b0], 0
je 0x1400402e9
mov eax, edi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, 0x6400000
ja 0x1400402e9
lea rcx, [rbp]
call fcn.1400155c0
nop
xor r8d, r8d
mov edx, edi
lea rcx, [rbp]
call fcn.140015620
lea rcx, [rbp]
call fcn.140015610
mov rdx, rax
mov r8d, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x140040be0
lea rcx, [rbp]
call fcn.140015600
jmp 0x1400402e9
lea rcx, [rbp]
call fcn.1400156d0
mov ecx, 0xff000000
and eax, ecx
bt eax, 0x18
jb 0x140040c90
cmp eax, 0x1000000
je 0x140040c90
lea ecx, [rax - 0x2000000]
test ecx, 0xfdffffff
je 0x140040c3b
cmp eax, 0x10000000
jne 0x140040cab
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2c8]
lea rdx, [rbp]
call qword [rax + 0x158]
jmp 0x140040cab
lea rcx, [rbp + 0x1b8]
call fcn.140015b20
nop
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.140015b90
test al, al
je 0x140040c82
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
lea rcx, [rbp]
call fcn.1400156d0
mov r8d, eax
lea rdx, [rbp + 0x1b8]
mov rcx, qword [rbx + 0x2c8]
call qword [rdi + 0x28]
nop
lea rcx, [rbp + 0x1b8]
call fcn.140015b40
jmp 0x140040cab
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x5b0
mov r8b, 1
lea rdx, [rbp]
call fcn.140015950
nop
lea rcx, [rbp]
call fcn.140015600
jmp 0x1400402e9
movsxd rcx, edi
inc rcx
call fcn.14013134c
mov r14, rax
movsxd rcx, edi
mov byte [rcx + rax], 0
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
jne 0x140040cf1
mov rcx, r14
call fcn.140131300
jmp 0x1400402e9
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140040d00
lea eax, [rdi + rdi]
movsxd rcx, eax
inc rcx
call fcn.14013134c
mov rsi, rax
mov rcx, r13
movsxd rax, edi
test edi, edi
jle 0x140040d54
mov rdx, r14
nop dword [rax + rax]
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140040d45
mov byte [rsi + rcx], reloc.WS2_32.dll_listen
inc rcx
movzx r8d, byte [rdx]
mov byte [rsi + rcx], r8b
inc rcx
inc rdx
sub rax, r12
jne 0x140040d30
mov byte [rsi + rcx], 0
mov rcx, r14
call fcn.140131300
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x5e0
mov rdx, rsi
call fcn.140017090
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x150]
mov rcx, rsi
call fcn.140131300
jmp 0x1400402e9
mov rcx, qword [rbx + 0x2c0]
call fcn.140082ab0
test al, al
jne case.0x14003ea21.8
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x859], r12b
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x859], 0
je 0x140040dee
call fcn.140087ee0
test eax, eax
jne 0x140040dfb
jmp case.0x14003ea21.1
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
mov rcx, qword [rbx + 0x2c0]
call fcn.140082ab0
cmp al, r12b
je 0x1400402e9
movzx ecx, byte [rbp + 0x141]
lea eax, [rcx - 1]
cmp al, 8
ja 0x1400402e9
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x854], ecx
movzx ecx, byte [rbp + 0x141]
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x850], ecx
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x57
lea rcx, [rbp + 0x90]
call fcn.140019e70
nop
movzx edx, byte [rbp + 0x141]
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x4b0]
call fcn.140034c10
mov rcx, qword [rbx + 0x2c8]
test eax, eax
jne 0x140040ea2
mov byte [rcx + 0x118], al
lea rcx, [rbp + 0x90]
call fcn.140019ea0
jmp 0x1400402e9
mov byte [rcx + 0x858], 1
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe434]
cdq
idiv ecx
mov dword [r8 + 0xe434], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe438]
cdq
idiv ecx
mov dword [r8 + 0xe438], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe42c]
cdq
idiv ecx
mov dword [r8 + 0xe42c], eax
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe430]
cdq
idiv ecx
mov dword [r8 + 0xe430], eax
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x2c8]
call fcn.1400443d0
nop
lea rcx, [rbp + 0x90]
call fcn.140019ea0
jmp 0x1400402e9
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
mov rax, qword [rbx + 0x2c8]
je 0x1400402e2
mov byte [rax + 0x9ca], r12b
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3c9], 0
je 0x1400402e9
lea r9, str.enabled
cmp byte [rbp + 0x141], r12b
lea rax, str.disabled
cmove r9, rax
lea r8, str.vncClientThread::run_:_rfbSetServerInput:_inputs__s_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d70
test al, al
jne 0x14004105a
cmp byte [rbp + 0x141], r12b
jne 0x14004105a
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
movzx edx, r12b
mov rcx, qword [rcx + 0x90]
call fcn.14004f780
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], r12b
jmp 0x1400402e9
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d70
test al, al
je 0x14004108f
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], 0
je 0x14004108f
cmp byte [rbp + 0x141], 0
je 0x1400410ce
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140036d70
test al, al
jne 0x1400402e9
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], al
jne 0x1400402e9
cmp byte [rbp + 0x141], al
jne 0x1400402e9
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004f780
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], 0
jmp 0x1400402e9
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
lea rcx, [rbp - 0x78]
call fcn.1400488f0
nop
mov esi, r13d
mov r14d, r13d
cmp byte [rbp + 0x146], r13b
jbe 0x14004125a
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x14004124c
movzx eax, word [rbp + 0x16c]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x54], eax
movzx eax, word [rbp + 0x16e]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x58], eax
movzx eax, word [rbp + 0x170]
rol ax, 8
movzx r8d, ax
mov dword [rbp - 0x5c], r8d
movzx eax, word [rbp + 0x172]
rol ax, 8
movzx edx, ax
mov dword [rbp - 0x60], edx
mov ecx, dword [rbp + 0x174]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
imul edx, r8d
cmp edx, 0xc00000
jg 0x140041237
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x5c]
lea rcx, [rbp + 0x118]
call fcn.140048c50
mov rdi, rax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xe0]
call fcn.140048c50
mov rdx, rax
mov r8, rdi
lea rcx, [rbp + 0x120]
call fcn.140048c60
mov r8, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140048c80
inc r14d
movzx eax, byte [rbp + 0x146]
cmp r14d, eax
jl 0x140041140
jmp 0x14004125a
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2c0]
mov edi, r13d
cmp dword [rax + 0xd4], r13d
cmovne edi, esi
cmp edi, 3
sete cl
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x4d8], cl
mov rcx, qword [rbx + 0x2c0]
cmp qword [rcx + 0xd8], 0
je 0x1400412ca
call fcn.140082ab0
test al, al
jne 0x1400412ca
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x108]
call fcn.1400338c0
mov r9, qword [rbx + 0x2c8]
lea r8, [r9 + 0xc]
movsx r10d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r10d
jmp 0x140041321
mov rcx, qword [rbx + 0x2c0]
cmp qword [rcx + 0xd8], 0
je 0x140041341
call fcn.140082ab0
test al, al
je 0x140041341
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x4d8], 0
je 0x140041341
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xe8]
call fcn.1400338c0
mov r9, qword [rbx + 0x2c8]
lea rdx, [r9 + 0xc]
movsx r8d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r8d
mov rcx, qword [rbx + 0x2c0]
movzx r9d, byte [r9 + 0x4d8]
mov r8, rax
mov edx, edi
mov rcx, qword [rcx + 0xd8]
call fcn.140032cb0
mov rcx, qword [rbx + 0x2c8]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax + 0xc], 0
jne 0x140041350
test rax, rax
jne 0x140041365
mov byte [rcx + 0x4d8], al
lea rcx, [rbp - 0x78]
call fcn.140032450
jmp 0x1400402e9
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
movzx r10d, word [rbp + 0x142]
rol r10w, 8
movzx edx, word [rbp + 0x144]
cmp r10w, 5
jae 0x1400413e9
movzx eax, dx
rol ax, 8
cmp ax, 5
jae 0x1400413e9
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x4b0]
mov r8d, r12d
mov edx, r12d
mov rcx, qword [rcx + 0x90]
call fcn.14004ef20
jmp 0x1400402e9
mov r9, qword [rbx + 0x2c8]
mov ecx, dword [r9 + 0x850]
rol dx, 8
movzx r8d, dx
add r8d, dword [r9 + 0x38c]
add r8d, dword [r9 + 0x384]
imul r8d, ecx
mov edx, dword [r9 + 0x388]
add edx, dword [r9 + 0x380]
movzx eax, r10w
add edx, eax
imul edx, ecx
mov rcx, qword [r9 + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.14004ef20
jmp 0x1400402e9
mov rcx, qword [rbx + 0x2c8]
mov edx, edi
mov rcx, qword [rcx + 0x880]
call fcn.14002c530
jmp 0x1400402e9
movzx r14d, r12b
mov rcx, qword [0x1401fdf60]
call fcn.140038970
test eax, eax
je 0x14004147e
mov rcx, qword [rbx + 0x2c8]
call fcn.1400478a0
movzx r14d, al
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x3c9], 0
je 0x140041497
cmp byte [rcx + 0x3ca], 0
jne 0x14004149a
xor r14b, r14b
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x58
lea rcx, [rbp + 0x80]
call fcn.140019e70
nop
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x67c], r12d
mov r8d, reloc.WS2_32.dll_inet_ntoa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x1400428e7
movzx eax, byte [rbp + 0x141]
dec eax
cmp eax, 0xf
ja case.0x14004150b.2
cdqe
mov ecx, dword [rsi + rax*4 + 0x42ed4]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80e], 1
jmp case.0x14004150b.2
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80e], 0
jmp case.0x14004150b.2
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x59
lea rcx, [rbp - 0x40]
call fcn.140019e70
nop
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je 0x140041bb3
test r14b, r14b
je 0x140041bb3
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
xor edx, edx
mov r8d, 0x144
call fcn.140133cd0
cmp edi, 0x138
ja 0x140041bb3
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
mov r8d, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140041bb3
mov ecx, dword [rbp + 0x144]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
mov dword [rsp + 0x70], r13d
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je 0x140041bb3
mov ecx, dword [rsp + 0x70]
mov r14d, ecx
and r14d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r14d, eax
shr r14d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r14d, eax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
mov edx, 0x2c
call fcn.140036d40
mov r15, rax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7cc
test rax, rax
jne 0x140041693
mov byte [rcx], al
jmp 0x1400416a0
lea rdx, [rax + 1]
call fcn.140048da0
mov byte [r15], 0
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
lea rcx, [rbp + 0x188]
call fcn.1400389c0
mov rcx, rax
call fcn.140021590
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
call fcn.140048db0
lea rcx, [rbp + 0x188]
call fcn.1400170b0
mov r12d, r13d
lea eax, [rdi + 0x41]
mov edi, eax
mov ecx, eax
call fcn.14013134c
mov r15, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140133cd0
mov r8, qword [rbx + 0x2c8]
add r8, 0x688
mov edx, edi
mov rcx, r15
call fcn.140139ff0
mov edx, 0x5c
mov rcx, r15
call fcn.140036d40
mov byte [rax], r12b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004176f
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x28]
mov rcx, r15
call rax
test eax, eax
mov eax, 0xffffffff
cmove r12d, eax
mov rcx, r15
call fcn.140131300
mov r8, qword [rbp + 0x28]
sar r8, 0xa
mov ecx, r14d
shl rcx, 0x20
mov eax, esi
add rcx, rax
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
cmp rax, rdx
mov esi, 0xffffffff
cmovl r12d, esi
mov ecx, 0x2400
call fcn.14013134c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e0], rax
mov rax, qword [rbx + 0x2c8]
cmp qword [rax + 0x7e0], 0
cmove r12d, esi
mov ecx, 0x2000
call fcn.14013134c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e8], rax
mov rcx, qword [rbx + 0x2c8]
cmp qword [rcx + 0x7e8], 0
cmove r12d, esi
xor eax, eax
mov qword [rbp + 0x178], rax
mov dword [rbp + 0x180], eax
mov byte [rbp + 0x178], 7
cmp r12d, esi
je 0x1400419ab
mov rax, qword [rcx + 0x110]
test rax, rax
je 0x140041846
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x688
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov eax, 4
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7f0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov rcx, qword [rbx + 0x2c8]
mov rdx, qword [rcx + 0x7f0]
mov edi, esi
cmp rdx, 0xffffffffffffffff
cmovne edi, r13d
mov r12d, edi
test al, al
je 0x1400419ab
cmp rdx, 0xffffffffffffffff
je 0x1400419ab
lea rdx, [rcx + 0x688]
lea r8, [rbp + 0x30]
call fcn.140047800
test al, al
je 0x1400419ab
mov rax, qword [rbp + 0x30]
shr rax, 0xd
lea esi, [rax*4 + 0x400]
movsxd rcx, esi
call fcn.14013134c
mov r15, rax
mov rcx, qword [rbx + 0x2c8]
mov r9d, esi
mov r8, rax
mov rdx, qword [rcx + 0x7f0]
call fcn.140046790
mov r14d, eax
cmp eax, 0xffffffff
je 0x1400419a6
mov byte [rbp + 0x179], reloc.WS2_32.dll_inet_ntoa
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shl edx, 8
mov ecx, esi
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr esi, 0x18
or edx, esi
mov dword [rbp + 0x17c], edx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r14d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r14d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x180], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx + 0x2b8]
call fcn.140087cf0
mov rcx, r15
call fcn.140131300
mov esi, 0xffffffff
mov byte [rbp + 0x179], 9
mov eax, r12d
bswap eax
mov dword [rbp + 0x17c], eax
mov rax, qword [rbx + 0x2c8]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400419d0
shr rcx, 0x18
movzx edx, cl
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400419f0
shl rcx, 8
and ecx, 0xff0000
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140041a10
shr rcx, 8
and ecx, 0xff00
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140041a30
shl rcx, 0x18
or edx, ecx
mov dword [rbp + 0x180], edx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov rdx, qword [rbx + 0x2c8]
add rdx, 0x688
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140041a76
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
mov r8, qword [rbx + 0x2c8]
cmp r12d, esi
jne 0x140041af9
lea rcx, [r8 + 0x7f0]
call fcn.140088300
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e8]
test rcx, rcx
je 0x140041ad1
call fcn.140131300
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e8], r13
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je 0x140041bb3
call fcn.140131300
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e0], r13
jmp 0x140041bb3
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8 + 0x7f8], edx
mov rcx, qword [rbx + 0x2c8]
mov eax, dword [rcx + 0x7f8]
shr eax, 0xd
mov dword [rcx + 0x7fc], eax
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x800], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x804], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80c], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 1
mov rcx, qword [0x1401fdf60]
call fcn.1400389a0
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.140087870
nop
lea rcx, [rbp - 0x40]
call fcn.140019ea0
jmp case.0x14004150b.2
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0xa0], xmm0
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0xb0], eax
movzx r8d, r14b
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbx + 0x2c8]
call fcn.140047f90
jmp case.0x14004150b.2
mov rcx, qword [0x1401fdf60]
call fcn.1400389a0
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2b8]
call fcn.1400877f0
mov ecx, dword [rbp + 0x148]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
call fcn.140046870
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
jmp case.0x14004150b.2
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov eax, 0xffffffff
cmp edx, eax
jne 0x140041cd7
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.140088300
jmp case.0x14004150b.2
mov ecx, 0x2000
call fcn.14013134c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e0], rax
mov rcx, qword [rbx + 0x2c8]
cmp qword [rcx + 0x7e0], 0
jne 0x140041d11
add rcx, 0x810
call fcn.140088300
jmp case.0x14004150b.2
mov ecx, 0x2400
call fcn.14013134c
mov rcx, qword [rbx + 0x2c8]
mov qword [rcx + 0x7e8], rax
mov rax, qword [rbx + 0x2c8]
cmp qword [rax + 0x7e8], 0
jne 0x140041d75
lea rcx, [rax + 0x810]
call fcn.140088300
mov rax, qword [rbx + 0x2c8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je case.0x14004150b.2
call fcn.140131300
mov rax, qword [rbx + 0x2c8]
mov qword [rax + 0x7e0], r13
jmp case.0x14004150b.2
mov byte [rax + 0x818], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x81c], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x824], r13d
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x829], 0
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 0
mov rcx, qword [rbx + 0x2c8]
call fcn.140046ed0
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
jmp case.0x14004150b.2
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
mov ecx, dword [rbp + 0x144]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x148]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2c8]
call fcn.1400468f0
mov rcx, qword [rbx + 0x2c8]
mov byte [rcx + 0x118], al
xor edx, edx
mov rcx, qword [rbx + 0x2c8]
call fcn.140047cc0
jmp case.0x14004150b.2
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x80d], 0
je case.0x14004150b.2
call fcn.140046a40
jmp case.0x14004150b.2
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x140041f01
mov byte [rax + 0x80c], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 1
mov rcx, qword [rbx + 0x2c8]
call fcn.140046a40
jmp case.0x14004150b.2
cmp byte [rax + 0x82a], 0
je 0x140041f24
mov byte [rax + 0x829], 1
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80f], 1
jmp case.0x14004150b.2
mov byte [rax + 0x85a], 1
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x85a], 0
je case.0x14004150b.2
xor eax, eax
mov qword [rbp + 0x1a8], rax
mov dword [rbp + 0x1b0], eax
mov byte [rbp + 0x1a8], 7
cmp word [rbp + 0x142], ax
jne 0x140041fa6
mov byte [rbp + 0x1a9], 7
mov eax, 0xffffffff
mov dword [rbp + 0x1ac], eax
mov rcx, qword [rbx + 0x2c8]
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rcx + 0x3b0]
call fcn.140087a20
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x85a], 0
jmp case.0x14004150b.2
mov byte [rbp + 0x1a9], recv
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je 0x140041f65
mov rcx, qword [0x1401fdf60]
call fcn.140038990
test eax, eax
je 0x140041f65
test r14b, r14b
je 0x140041f65
mov dword [rbp + 0x1ac], 0x1000000
jmp 0x140041f70
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x14004211c
cmp ecx, 1
jne case.0x14004150b.2
lea rdx, [rbp + 0x2f0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov r15d, eax
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
lea esi, [r15 - 3]
test esi, esi
je 0x1400420ac
mov edi, 2
nop word [rax + rax]
lea ecx, [rdi - 2]
lea rdx, [rbp + 0x2f0]
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140048dc0
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x140042098
sub eax, 1
je 0x14004208c
sub eax, 1
je 0x140042080
cmp eax, 1
jne 0x1400420a2
mov eax, edi
mov byte [rbp + rax + 0x2f0], Ordinal_102
jmp 0x1400420a2
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSACleanup
jmp 0x1400420a2
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSAGetLastError
jmp 0x1400420a2
mov eax, edi
mov byte [rbp + rax + 0x2f0], reloc.dwmapi.dll_Ordinal_102
add edi, 4
lea eax, [rdi - 2]
cmp eax, esi
jb 0x140042040
mov qword [rbp + 0x1f8], 0x30207
mov ecx, r15d
shl ecx, 0x10
mov eax, r15d
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r15d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r15d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x200], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov r8d, r15d
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
jmp case.0x14004150b.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x105
ja case.0x14004150b.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14004150b.2
cmp edi, 0x106
jae 0x140042d7c
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
xor sil, sil
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.My_Documents
lea rcx, [rbp + 0x2f0]
call fcn.14014a7d0
mov r15, 0xffffffffffffffff
mov edi, r15d
test eax, eax
mov eax, 5
cmove edi, eax
lea r8d, [r15 + 8]
lea rdx, str.Desktop
lea rcx, [rbp + 0x2f0]
call fcn.14014a7d0
test eax, eax
cmove edi, r13d
lea r8d, [r15 + 0x12]
lea rdx, str.Network_Favorites
lea rcx, [rbp + 0x2f0]
call fcn.14014a7d0
test eax, eax
jne 0x14004220e
lea edi, [rax + 0x13]
jmp 0x140042213
cmp edi, r15d
je 0x140042275
lea r8, [rbp + 0xa70]
mov edx, edi
mov rcx, qword [rbx + 0x2c8]
call fcn.140047430
test al, al
je 0x140042272
lea rcx, [rbp + 0xa70]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], sil
jne 0x140042236
cmp byte [rbp + rax + 0xa6f], 0x5c
je 0x14004225d
lea rdx, [0x1401c3128]
lea rcx, [rbp + 0xa70]
call fcn.140048dd0
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x2f0]
call fcn.140048de0
jmp 0x140042275
mov sil, 1
lea rdx, [0x1401c88b4]
lea rcx, [rbp + 0x2f0]
call fcn.140048dd0
mov qword [rbp + 0x15c], r13
mov dword [rbp + 0x158], 0x10207
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp r14, r15
je 0x140042457
test sil, sil
jne 0x140042457
lea rax, [rbp + 0x2f0]
mov rdx, r15
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400422e0
dec rdx
mov rax, rdx
shr rax, 0x18
movzx ecx, al
mov rax, rdx
shl rax, 8
and eax, 0xff0000
or ecx, eax
mov rax, rdx
shr rax, 8
and eax, 0xff00
or ecx, eax
shl rdx, 0x18
or ecx, edx
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
lea rcx, [rbp + 0x2f0]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x140042344
lea r8d, [rax - 1]
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087cf0
nop word [rax + rax]
movzx ecx, byte [rbp + 0x56d]
movzx eax, byte [rbp + 0x56c]
test byte [rbp + 0x540], 0x10
je 0x14004238f
cmp al, 0x2e
jne 0x1400423ac
test cl, cl
jne 0x1400423ac
cmp al, 0x2e
jne 0x1400423ac
cmp cl, al
jne 0x1400423a0
cmp byte [rbp + 0x56e], 0
je 0x1400423ac
cmp al, 0x2e
jne 0x1400423ac
test cl, cl
je 0x14004242e
lea rcx, [rbp + 0x56c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [rax + 0x2e]
movsxd r8, edi
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x750]
call fcn.140133620
mov eax, edi
mov ecx, edi
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
mov eax, edi
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, edi
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov r8d, edi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087cf0
lea rdx, [rbp + 0x540]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140042370
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov word [rbp + 0x15a], r13w
mov dword [rbp + 0x160], r13d
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087a20
jmp case.0x14004150b.2
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x1400427c9
sub ecx, 3
je 0x140042632
cmp ecx, 1
jne case.0x14004150b.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x208
ja case.0x14004150b.2
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14004150b.2
cmp esi, 0x209
jae 0x140042d82
mov byte [rbp + rsi + 0x750], 0
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
mov edx, 0x2a
lea rcx, [rbp + 0x750]
call fcn.140036d40
mov rdi, rax
test rax, rax
je case.0x14004150b.2
lea rdx, [rax + 1]
lea rcx, [rbp + 0x540]
call fcn.140048df0
mov byte [rdi], 0
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0xa70]
call fcn.140048df0
mov byte [rdi], 0x2a
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
mov dword [rbp + 0x208], 0x80b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x20c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x210], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x208]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
test edi, edi
je case.0x14004150b.2
lea rax, [rbp + 0x188]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x188]
call fcn.1400215a0
mov rdi, rax
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x1b8]
call fcn.1400215a0
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d80
jmp case.0x14004150b.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x104
ja case.0x14004150b.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14004150b.2
cmp edi, 0x105
jae 0x140042d88
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
lea rcx, [rbp + 0x2f0]
call fcn.140038d20
movzx r14d, al
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x188]
call fcn.1400215a0
nop
test r14b, r14b
je 0x14004270e
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140038cb0
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.140048b40
lea rcx, [rbp + 0x1b8]
call fcn.1400170b0
lea rcx, [rbp + 0x188]
call fcn.140048aa0
mov rsi, rax
lea rcx, [rbp + 0x2f0]
call fcn.140038be0
movzx edi, al
mov dword [rbp + 0x218], 0x70b07
mov ecx, 0xffffffff
test al, al
cmovne ecx, r13d
mov dword [rbp + 0x21c], ecx
lea eax, [rsi + 1]
bswap eax
mov dword [rbp + 0x220], eax
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x218]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
lea rcx, [rbp + 0x188]
call fcn.140021590
mov rdx, rax
lea r8d, [rsi + 1]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
test edi, edi
je 0x1400427b8
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.1400215a0
movzx r8d, r14b
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d70
nop
lea rcx, [rbp + 0x188]
call fcn.1400170b0
jmp case.0x14004150b.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x104
ja case.0x14004150b.2
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14004150b.2
cmp esi, 0x105
jae 0x140042d76
mov byte [rbp + rsi + 0x2f0], 0
mov rcx, qword [0x1401fdf60]
call fcn.140038960
test eax, eax
je case.0x14004150b.2
test r14b, r14b
je case.0x14004150b.2
xor edx, edx
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov dword [rbp + 0x228], 0x40b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x22c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x230], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x228]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087b50
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140087bd0
test edi, edi
je case.0x14004150b.2
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.1400215a0
mov rdx, rax
mov rcx, qword [rbx + 0x2c8]
call fcn.140038d60
jmp case.0x14004150b.2
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x14004293a
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7f0
call fcn.140088300
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 0
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x82a], 0
je case.0x14004150b.2
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.140088300
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 0
mov rax, qword [rbx + 0x2c8]
mov dword [rax + 0x67c], r13d
lea rcx, [rbp + 0x80]
call fcn.140019ea0
jmp 0x1400402e9
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.140087ee0
test eax, eax
je case.0x14003ea21.1
mov rcx, qword [rbx + 0x2b8]
call fcn.140036d30
jmp 0x1400402e9
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
lea rcx, [rbp - 0x20]
call fcn.140019ea0
jmp 0x140042d46
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x118], 0
cmp byte [0x1401f32c3], 0
je 0x140042a2b
mov byte [rbx + 0xa8], 1
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x80d], 0
je 0x140042a7e
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x80d], 0
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x7f0
call fcn.140088300
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x82a], 0
je 0x140042ac3
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2c8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x82a], 0
mov rcx, qword [rbx + 0x2c8]
add rcx, 0x810
call fcn.140088300
mov rcx, qword [rbp + 0x38]
call fcn.140020bb0
mov rcx, qword [rbx + 0x2c8]
cmp byte [rcx + 0x9c9], 0
je 0x140042aff
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.14004f780
mov rax, qword [rbx + 0x2c8]
mov byte [rax + 0x9c9], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140042b27
call qword [sym.imp.USER32.dll_CloseDesktop]
test eax, eax
jne 0x140042b27
lea r8, str.vncClientThread::run_:_failed_to_close_desktop_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rax, qword [rbx + 0x2c8]
mov r9, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [r9 + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_disconnected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov r8d, 0x104
lea rdx, [rbp + 0x960]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140042bac
mov edx, 0x5c
lea rcx, [rbp + 0x960]
call fcn.140036d40
mov byte [rax], 0
lea rdx, str.logging.dll
lea rcx, [rbp + 0x960]
call fcn.1400181d0
lea rcx, [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x140042c47
lea rdx, str.LOGEXIT
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rdx, qword [rbx + 0x2c8]
cmp byte [rdx + 0x3c9], 0
je 0x140042bf6
cmp byte [rdx + 0x3ca], 0
je 0x140042bf6
mov r12b, 1
jmp 0x140042bf9
xor r12d, r12d
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x2c8]
mov rdi, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx r14d, ax
mov rcx, rsi
call qword [rdi + 0x90]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x98]
mov rcx, rax
movzx r9d, r12b
mov r8d, r14d
mov rdx, rdi
call r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rcx + 0x590]
test rax, rax
je 0x140042c7e
mov rcx, rax
call fcn.140038e60
mov rcx, qword [rbx + 0x2c8]
xor edx, edx
mov rcx, qword [rcx + 0x590]
call fcn.1401249d0
mov rcx, qword [rbx + 0x2c8]
mov rax, qword [rbx + 0x2c0]
mov rdi, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2c0]
call qword [rdi + 0xb8]
cmp byte [0x1401f32c3], 0
jne 0x140042d46
mov rax, qword [rbx + 0x2c8]
cmp byte [rax + 0x3af], 0
je 0x140042d46
lea r8, str.vncClientThread::run_:_PostAddNewClient_II_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rbx + 0x2c8]
mov r8, qword [rcx]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0xac]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xb0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2c0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x1af]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140020d80
mov rcx, qword [rbp + 0xc80]
xor rcx, rsp
call fcn.1401312e0
lea r11, [rsp + 0xd90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401316d8
nop
call fcn.1401316d8
int3
call fcn.1401316d8
int3
call fcn.1401316d8
int3