Function at 0x422730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
mov dword [esi + 0xe130], edi
cmp dword [ebp + 8], edi
jne 0x422786
cmp ebx, edi
jne 0x422786
mov ecx, dword [esi + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc0]
call edx
test eax, eax
jne 0x422786
mov ecx, dword [esi + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc4]
push 1
mov dword [ebp + 8], 1
call edx
push str.._vncdesktop.cpp_:_SethookMechanism_called_r_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [0x4bb5d4]
add esp, 4
cmp eax, 4
je 0x42292b
cmp eax, 5
je 0x42292b
mov edx, 1
cmp eax, edx
je 0x42280f
cmp eax, 2
je 0x42280f
cmp dword [ebp + 8], edi
jne 0x4227cc
mov dword [esi + 0xe128], edi
jmp 0x4227d2
mov dword [esi + 0xe128], edx
mov eax, dword [esi + 0xe12c]
xor ecx, ecx
cmp dword [esi + 0xe128], edi
mov dword [esi + 0xa0], edi
setne cl
xor edx, edx
cmp eax, ecx
setne dl
mov dword [esi + 0xe12c], ecx
mov dword [esi + 0xe134], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], edi
jne 0x422826
mov dword [esi + 0xe128], edi
cmp ebx, edi
jne 0x422830
mov dword [esi + 0xa0], edi
jmp 0x422836
cmp ebx, edi
je 0x42285b
mov dword [esi + 0xe128], edi
mov dword [esi + 0xa0], edx
mov ecx, dword [esi + 0xe128]
mov eax, dword [esi + 0xe12c]
xor ebx, ebx
cmp ecx, edi
setne bl
mov dword [esi + 0xe12c], ebx
cmp eax, ebx
je 0x422869
mov dword [esi + 0xe134], edx
jmp 0x42286f
mov dword [esi + 0xe128], edx
mov dword [esi + 0xa0], edi
jmp 0x422836
mov dword [esi + 0xe134], edi
cmp dword [0x4bb5d4], 2
jne 0x42287e
mov dword [esi + 0xe134], edx
mov eax, dword [esi + 0xa0]
push eax
push ecx
push str.._vncdesktop.cpp_:_Sethook_restart_wanted_hook_d_driver_d__r_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 0xc
cmp dword [esi + 0xe134], edi
je 0x4228b6
push str.._vncdesktop.cpp_:_Hookdll_status_changed__r_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov ecx, dword [esi + 0xa0]
cmp ecx, edi
je 0x4228ea
mov eax, dword [esi + 0xe0fc]
cmp eax, edi
je 0x4228f9
cmp dword [eax + 8], edi
jne 0x4228e2
mov eax, 1
mov dword [esi + 0xe130], eax
mov dword [esi + 0xe134], eax
jmp 0x4228fe
cmp ecx, edi
jne 0x4229ab
mov ecx, esi
call fcn.00422420
test eax, eax
je 0x4229ab
mov eax, 1
mov dword [esi + 0xe130], eax
push str.._vncdesktop.cpp_:_Driver_Status_changed_r_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0xa0], edi
mov dword [esi + 0xe128], edi
cmp dword [ebp + 8], edi
jne 0x422940
cmp ebx, edi
je 0x42294a
mov dword [esi + 0xe128], 1
mov eax, dword [esi + 0xe13c]
cmp eax, edi
je 0x422968
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0xe13c], edi
mov dword [esi + 0xe11c], edi
mov dword [esi + 0xe11c], edi
cmp ebx, edi
je 0x422979
push 1
call fcn.004229c0
mov eax, dword [esi + 0xe12c]
cmp ebx, edi
jne 0x422990
cmp dword [ebp + 8], edi
jne 0x422990
mov dword [esi + 0xe12c], edi
jmp 0x42299a
mov dword [esi + 0xe12c], 1
xor ecx, ecx
cmp eax, dword [esi + 0xe12c]
setne cl
mov dword [esi + 0xe134], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret 4