Function at 0x14003f620
Capabilities:
Create directory
Enumerate files on windows
Get disk information
Get hostname
Hash data using murmur3
Move file
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc90]
sub rsp, 0xd90
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rbp + 0xc80], rax
mov rbx, rcx
mov qword [rbp + 0x20], rcx
xor r13d, r13d
mov qword [rcx + 0x2d8], r13
mov qword [rcx + 0x2e0], r13
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003f6b3
lea rdx, str.InjectTouchInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2d8], rax
lea rdx, str.InitializeTouchInjection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2e0], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [rbx + 0x2b8]
mov rdx, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_connected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140018d00
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp + 0x38], rax
mov qword [rbp - 0x28], r13
mov rcx, qword [rbx + 0x2b8]
mov rdx, qword [rcx + 0x4f8]
mov rcx, qword [rbx + 0x2b0]
mov r8, qword [rcx]
call qword [r8 + 0x1e0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x40]
test al, al
je 0x14003f867
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
jne 0x14003f896
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], r13b
je 0x14003f867
cmp byte [0x14021fa63], r13b
jne 0x14003f867
mov rdx, qword [rbx + 0x2b0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
test ecx, ecx
jle 0x14003f7c2
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0x98], 0
jne 0x140044436
inc r13d
mov rdx, qword [rbx + 0x2b0]
mov eax, dword [rdx + 0xb8]
lea ecx, [rax + rax*4]
add ecx, ecx
cmp r13d, ecx
jl 0x14003f790
add dword [rdx + 0xb8], 0xa
mov rax, qword [rbx + 0x2b0]
cmp dword [rax + 0xb8], 0x14
jle 0x14003f7e3
mov dword [rax + 0xb8], reloc.WS2_32.dll_sendto
lea r8, str.vncClientThread::run_:_PostAddNewClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x2b0]
mov r8, qword [rcx]
mov rax, qword [rbx + 0x2b8]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0x9c]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xa0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x19f]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140021520
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
jmp 0x140044436
mov rax, qword [rbx + 0x2b0]
mov dword [rax + 0xb8], r13d
lea r8, str.vncClientThread::run_:_negotiated_version_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x14003f913
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
cmp byte [0x14021fa63], r13b
jne 0x140044436
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], r13b
jmp 0x1400443ac
mov rdx, qword [rbx + 0x2b8]
cmp byte [rdx + 0x10c], r13b
jne 0x14003f941
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov rdx, qword [rdx + 0x4f8]
call qword [rax + 0x1e8]
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + 0x10c], r13b
mov rax, qword [0x14022a710]
imul edx, dword [rax + 0x758], 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.14008a9e0
lea r8, str.vncClientThread::run_:_authenticated_connection_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov rcx, qword [rbx + 0x2b8]
call qword [rdi + 0x108]
mov rax, qword [rbx + 0x2b0]
mov rcx, qword [rbx + 0x2b8]
cmp qword [rax + 0x138], 1
ja 0x14003f9fe
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [0x14022a710]
mov r8, qword [rbx + 0x2b8]
mov edx, dword [rcx + 0x7a0]
mov rcx, qword [r8 + 0x4b0]
call fcn.140035e00
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003fa52
mov rax, qword [rax + 0x108]
mov r10, qword [rcx]
cmp dword [rax + 0xe478], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xd8]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2b0]
mov rdx, qword [rax + 0x108]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xd0]
mov rcx, qword [rbx + 0x2b8]
lea rdx, [rbp + 0x90]
mov rcx, qword [rcx + 0x4b0]
call fcn.140035e90
mov rcx, qword [rbx + 0x2b8]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x840], xmm0
mov rdx, qword [rbx + 0x2b8]
mov rax, qword [rdx + 0x4b0]
mov ecx, dword [rax + 0x14]
mov dword [rdx + 0x850], ecx
mov dword [rbp - 0x4c], 0x130
xor edx, edx
mov r8d, 0x132
lea rcx, [rbp + 0x400]
call fcn.14014a5c0
lea rdx, [rbp - 0x4c]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rsi, 0xffffffffffffffff
mov r14d, 0x100
lea rcx, [rbp + 0x400]
test eax, eax
je 0x14003fb3a
mov rdi, r13
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14003fae0
test rax, rax
je 0x14003fb1f
nop
movsx ecx, byte [rbp + rdi + 0x400]
call fcn.14015a9c4
mov byte [rbp + rdi + 0x400], al
inc rdi
lea rcx, [rbp + 0x400]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003fb11
cmp rdi, rax
jb 0x14003faf0
mov edx, 0x2e
lea rcx, [rbp + 0x400]
call fcn.14015bb8c
test rax, rax
je 0x14003fb4b
jmp 0x14003fbc8
lea r8, str.WinVNC
mov edx, 0x132
call fcn.140150800
mov edx, r14d
lea rcx, [rbp + 0x2f0]
call fcn.14003ef60
lea rcx, [rbp + 0x2f0]
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x14003fb64
cmp rax, 3
jbe 0x14003fbc8
movzx eax, byte [rbp + 0x2f0]
sub al, 0x48
cmp al, 1
jbe 0x14003fbc8
lea r8, [0x1401f6034]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.140150860
lea r8, [rbp + 0x2f0]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.140150860
lea r8, [0x1401f6038]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.140150860
lea r8, [0x1401f603c]
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.140150860
mov rax, qword [0x14022a710]
lea rcx, str.application_mode
lea r8, str.service_mode
cmp dword [rax + 0xe20], 0
cmove r8, rcx
mov edx, 0x132
lea rcx, [rbp + 0x400]
call fcn.140150860
mov r8, qword [rbx + 0x2b8]
mov rax, qword [r8 + 0x4b0]
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0x23c], xmm0
mov ecx, dword [r8 + 0x848]
mov eax, dword [r8 + 0x840]
mov edx, ecx
sub edx, eax
sar edx, 8
mov r9d, 0xff
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x238], dx
mov ecx, dword [r8 + 0x84c]
mov eax, dword [r8 + 0x844]
mov edx, ecx
sub edx, eax
sar edx, 8
and dx, r9w
sub cx, ax
movzx ecx, cx
imul ecx, r14d
or dx, cx
mov word [rbp + 0x23a], dx
movq rax, xmm0
shr rax, 0x20
rol ax, 8
mov word [rbp + 0x240], ax
rol word [rbp + 0x242], 8
rol word [rbp + 0x244], 8
lea rax, [rbp + 0x400]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003fcc0
mov eax, edi
bswap eax
mov dword [rbp + 0x24c], eax
mov r8d, 0x18
lea rdx, [rbp + 0x238]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008af60
test eax, eax
je 0x14003f867
mov r8d, edi
lea rdx, [rbp + 0x400]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
test eax, eax
je 0x14003f867
lea r8, str.vncClientThread::run_:_sent_pixel_format_to_client_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x5b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x840
lea rcx, [rbp - 0x78]
call fcn.140025ca0
nop
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x70]
call fcn.14014e740
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 2
mov rcx, rbx
call fcn.1400b2480
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 1
mov rax, qword [0x14022a710]
mov eax, dword [rax + 0x77c]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x50], 1
xor al, al
mov byte [rsp + 0x42], al
xor cl, cl
mov byte [rsp + 0x41], cl
xor r14b, r14b
mov byte [rsp + 0x46], r14b
xor r12b, r12b
mov byte [rsp + 0x43], r12b
mov byte [rsp + 0x51], 1
xor dil, dil
mov byte [rsp + 0x44], dil
xor r15b, r15b
mov byte [rsp + 0x47], r15b
xor sil, sil
mov byte [rsp + 0x45], sil
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x118], al
je 0x140044100
nop word [rax + rax]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], eax
mov rax, qword [rcx]
call qword [rax + 0x138]
test al, al
jne 0x14003fe80
call fcn.140021170
test eax, eax
jne 0x14003fe80
lea r8, str.vncClientThread::run_:_vncClientThread__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.140021440
test eax, eax
je 0x140044100
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3c9], 0
je 0x14003feb2
cmp byte [rsp + 0x50], 0
je 0x14003feb2
mov cl, reloc.WS2_32.dll_sendto
call fcn.14003eee0
mov cl, 0x91
call fcn.14003eee0
xor al, al
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 0x2b8]
cmp dword [rsp + 0x68], 0
je 0x14003fed8
mov rcx, qword [rcx + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.140050990
mov dword [rsp + 0x68], r13d
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x4b0]
movzx edx, byte [rsp + 0x51]
mov rcx, qword [rcx + 0x90]
call fcn.1400512e0
mov byte [rsp + 0x51], 0
cmp byte [rsp + 0x42], 0
je 0x14003ff2f
mov rax, qword [0x14022a710]
mov r8d, dword [rax + 0x118]
mov edx, 2
mov rcx, qword [rbx + 0x2b8]
call fcn.1400493a0
mov dl, 1
mov rcx, qword [rbx + 0x2b8]
call fcn.140049460
xor al, al
mov byte [rsp + 0x42], al
cmp byte [rsp + 0x41], 0
je 0x14003ff4a
mov dl, 1
mov rcx, qword [rbx + 0x2b8]
call fcn.140049460
xor cl, cl
mov byte [rsp + 0x41], cl
test r14b, r14b
je 0x14003ff73
mov rax, qword [0x14022a710]
mov r8d, dword [rax + 0x11c]
mov edx, 3
mov rcx, qword [rbx + 0x2b8]
call fcn.1400493a0
mov byte [rsp + 0x46], 0
test r12b, r12b
je 0x14003ff89
mov rcx, qword [rbx + 0x2b8]
call fcn.140049410
mov byte [rsp + 0x43], 0
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x378], 0
je 0x14003ffc2
cmp byte [rax + 0x9ca], 0
je 0x14003ffc2
mov byte [rax + 0x378], 0
mov rcx, qword [rbx + 0x2b8]
mov r8d, dword [rcx + 0x374]
mov edx, dword [rcx + 0x370]
call fcn.1400493a0
test dil, dil
je 0x14003ffd8
mov rcx, qword [rbx + 0x2b8]
call fcn.140049520
mov byte [rsp + 0x44], 0
test r15b, r15b
je 0x14003ffee
mov rcx, qword [rbx + 0x2b8]
call fcn.140049570
mov byte [rsp + 0x47], 0
test sil, sil
je 0x140040004
mov rcx, qword [rbx + 0x2b8]
call fcn.140049690
mov byte [rsp + 0x45], 0
mov r12d, 1
mov edi, r12d
mov rax, qword [rbx + 0x2a8]
cmp byte [rax + 0x31], 0
jne 0x140040059
cmp byte [rax + 0x30], 0
je 0x140040059
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x210]
cmp byte [rax + 0x39], 0
je 0x140040059
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400440f2
mov edi, r13d
jmp 0x140040077
mov r8d, r12d
lea rdx, [rbp + 0x140]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400440f2
movzx eax, byte [rbp + 0x140]
cmp eax, 0xfe
ja case.0x1400400a2.1
lea rsi, [0x140000000]
movzx eax, byte [rsi + rax + 0x444c8]
mov ecx, dword [rsi + rax*4 + 0x44480]
add rcx, rsi
jmp rcx
mov byte [rsp + 0x41], r12b
jmp 0x14004198e
mov r8d, reloc.WS2_32.dll_sendto
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140041987
rol word [rbp + 0x148], 8
rol word [rbp + 0x14a], 8
rol word [rbp + 0x14c], 8
mov edx, r13d
cmp byte [rbp + 0x151], r12b
sete dl
mov rcx, qword [rax + 0x4b0]
mov dword [rcx + 0x9c], edx
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
lea rdx, [rbp + 0x144]
call fcn.140039090
test eax, eax
jne 0x140040161
lea r8, str.vncClientThread::run_:_remote_pixel_format_invalid_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x5a8], r12d
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xb0]
jmp 0x14004198e
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
mov rcx, qword [rbx + 0x2b8]
mov dword [rcx + 0x4a0], r13d
xor edx, edx
mov rcx, qword [rcx + 0x4b0]
call fcn.140037ec0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x48c], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x490], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x494], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x498], r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
mov rdi, 0xffffffffffffffff
mov edx, edi
call fcn.140039290
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x478], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x140040239
mov dword [rcx + 0x7c], edi
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x470], 6
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14004025d
mov dword [rcx + 0x74], 6
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x480], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14004027e
mov dword [rcx + 0x84], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14004029f
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x1400402ce
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
rol word [rbp + 0x142], 8
mov esi, r13d
mov r15d, r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x20]
mov r14d, r13d
cmp r13w, word [rbp + 0x142]
jae 0x1400409f9
nop dword [rax]
mov dword [rsp + 0x48], r13d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400409e3
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov r8d, edi
and r8d, 0xff00
mov ecx, edi
shl ecx, 0x10
or ecx, r8d
shl ecx, 8
or ecx, edx
cmp ecx, 1
jne 0x1400403d1
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x540
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x20]
jmp 0x1400409ce
cmp ecx, 0xffffff21
jne 0x1400403ec
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x648], r12d
jmp 0x1400409ce
cmp ecx, 0xfffffecc
jne 0x140040407
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x64c], r12d
jmp 0x1400409ce
cmp ecx, 0xffff0001
jne 0x140040449
mov rcx, qword [rbx + 0x2b8]
mov dword [rcx + 0x4a0], r12d
mov edx, r12d
mov rcx, qword [rcx + 0x4b0]
call fcn.140037ec0
lea r8, str.vncClientThread::run_:_Cache_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
jmp 0x1400409ce
cmp ecx, 0xffff000b
jne 0x140040468
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x48c], r12d
lea r8, str.vncClientThread::run_:_XOR_protocol_extension_enabled_n
jmp 0x140040433
lea eax, [rcx + 0x100]
cmp eax, 9
ja 0x1400404d6
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x100]
mov rax, qword [rbx + 0x2b8]
mov ecx, 6
cmp r9d, 9
cmovbe ecx, r9d
mov dword [rax + 0x470], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x1400404b9
mov eax, 6
cmp ecx, 9
cmovbe eax, ecx
mov dword [rdx + 0x74], eax
lea r8, str.vncClientThread::run_:_compression_level_requested:__d_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
jmp 0x1400409ce
cmp ecx, 0xffffffe0
jb 0x140040512
cmp ecx, 0xffffffe9
ja 0x1400408ab
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
lea edx, [rdi + 0x20]
call fcn.140039290
lea r9d, [rdi + 0x20]
lea r8, str.vncClientThread::run_:_image_quality_level_requested:__d_n
jmp 0x1400404c0
cmp ecx, 0xfffffe00
jb 0x1400406da
cmp ecx, 0xfffffe64
ja 0x140040579
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
lea r9d, [rdi + 0x200]
mov rax, qword [rbx + 0x2b8]
mov rdi, 0xffffffffffffffff
mov ecx, edi
cmp r9d, 0x64
cmovbe ecx, r9d
mov dword [rax + 0x478], ecx
mov rdx, qword [rax + 0x408]
test rdx, rdx
je 0x14004056d
mov eax, edi
cmp ecx, 0x64
cmovbe eax, ecx
mov dword [rdx + 0x7c], eax
lea r8, str.vncClientThread::run_:_fine_grained_image_quality_level_requested:__d_n
jmp 0x1400404c0
cmp ecx, 0xffffff20
jne 0x1400405ae
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x480], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x1400405a2
mov dword [rcx + 0x84], r12d
lea r8, str.vncClientThread::run_:_LastRect_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xffffff10
jne 0x140040631
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x484], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x1400405d7
mov dword [rcx + 0x88], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_X_style_cursor_shape_updates_enabled_n
jmp 0x140040433
cmp ecx, 0xffffff11
jne 0x1400406b4
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r12d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14004065a
mov dword [rcx + 0x8c], r12d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, r12d
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8009
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
lea r8, str.vncClientThread::run_:_Full_color_cursor_shape_updates_enabled_n
jmp 0x140040433
cmp ecx, 0xffffff18
jne 0x140040856
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r12d
lea r8, str.vncClientThread::run_:_PointerPos_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xfffffd00
jb 0x14004072d
cmp ecx, 0xfffffd05
ja 0x1400408ab
shl edi, 0x10
or edi, r8d
shl edi, 8
or edi, edx
add edi, 0x300
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x47c], edi
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x14004071e
mov dword [rcx + 0x80], edi
mov r9d, edi
lea r8, str.vncClientThread::run_:_subsampling_requested:__d_n
jmp 0x1400404c0
cmp ecx, 0xffff8000
jne 0x14004075d
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c8], 1
mov rax, qword [0x14022a710]
mov byte [rax + 0xe1c], 1
lea r8, str.vncClientThread::run_:_ServerState_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xffff8003
jne 0x14004077f
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9cc], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xffff8001
jne 0x1400407b4
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9cb], 1
mov rax, qword [0x14022a710]
mov byte [rax + 0xe1d], 1
mov byte [rsp + 0x42], 1
lea r8, str.vncClientThread::run_:_KeepAlive_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xffff8004
jne 0x1400407cd
mov byte [rsp + 0x46], 1
lea r8, str.vncClientThread::run_:_IdleTime_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xffff8005
jne 0x1400407fd
mov byte [rsp + 0x43], 1
lea r8, str.vncClientThread::run_:_IdleTime_protocol_extension_enabled_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r12d, 1
jmp 0x1400409ce
cmp ecx, 0xffff8002
jne 0x140040816
mov byte [rsp + 0x44], 1
lea r8, str.vncClientThread::run_:_FTProtocolVersion_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xc0a1e5ce
jne 0x14004083d
mov byte [rsp + 0x47], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x5b0], 1
lea r8, str.vncClientThread::run_:_Extended_clipboard_protocol_extension_enabled_n
jmp 0x140040433
cmp ecx, 0xc0a1e5cf
jne 0x140040856
mov byte [rsp + 0x45], 1
lea r8, str.vncClientThread::run_:_Streaming_DSM_support_enabled_n
jmp 0x140040433
cmp ecx, 0xfffffecf
jne 0x14004087e
lea r8, str.vncClientThread::run_:_Gii_Encoding_found_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r15d, r12d
jmp 0x1400409ce
cmp ecx, 0x10
jne 0x1400408ab
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x490], r12d
lea r8, str.vncClientThread::run_:_ZRLE_found__n
lea edx, [rcx - 7]
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov edi, dword [rsp + 0x48]
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
shr edx, 8
mov ecx, edi
shl ecx, 0x10
mov eax, edi
and eax, 0xff00
or ecx, eax
shl ecx, 8
or edx, ecx
cmp edx, 0x12
jne 0x1400408ff
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x494], r12d
lea r8, str.vncClientThread::run_:_XZ_found__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov edi, dword [rsp + 0x48]
mov ecx, edi
and ecx, 0xff0000
mov eax, edi
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shl eax, 8
or ecx, eax
cmp ecx, 7
jne 0x14004094c
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x498], r12d
lea r8, str.vncClientThread::run_:_Tight_found_n
lea edx, [rcx + 2]
lea rcx, vtable.VNCLog.0
call fcn.140018d00
test esi, esi
jne 0x1400409ce
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], 0x55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, dword [rsp + 0x48]
mov edx, r8d
and edx, 0xff0000
mov ecx, r8d
shr ecx, 0x10
or edx, ecx
shr edx, 8
mov eax, r8d
shl eax, 0x10
and r8d, 0xff00
or eax, r8d
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
xor r8d, r8d
call fcn.140038340
test eax, eax
cmovne esi, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc r14d
movzx eax, word [rbp + 0x142]
cmp r14d, eax
jl 0x140040360
jmp 0x1400409f1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
test esi, esi
jne 0x140040a84
lea r8, str.vncClientThread::run_:_defaulting_to_raw_encoder_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x56
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
xor r8d, r8d
xor edx, edx
call fcn.140038340
test eax, eax
jne 0x140040a7b
lea r8, str.vncClientThread::run_:_failed_to_select_raw_encoder__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x2b8]
cmp dword [rax + 0x670], 0
jne 0x140040b2b
mov dword [rax + 0x484], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x140040ab2
mov dword [rcx + 0x88], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x488], r13d
mov rcx, qword [rax + 0x408]
test rcx, rcx
je 0x140040ae1
mov dword [rcx + 0x8c], r13d
mov rax, qword [rax + 0x4b0]
mov dword [rax + 0x98], r12d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x670], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x218]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x664], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x668], r13d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp eax, 1
jbe 0x140040b4d
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x228]
test r15d, r15d
je 0x140040b7e
cmp qword [rbx + 0x2d8], 0
je 0x140040b7e
cmp qword [rbx + 0x2e0], 0
je 0x140040b7e
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3cb], 0
je 0x140040b7e
mov rcx, rbx
call fcn.14003beb0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x3a8], r12d
jmp 0x14004016f
mov byte [rsp + 0x40], 0
mov word [rsp + 0x4c], r13w
xor sil, sil
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x308
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x140040c0b
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_subtype_failed___n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14004198e
mov edi, 2
mov r8d, edi
lea rdx, [rsp + 0x4c]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x140040c31
lea r8, str.vncClientThread::run_:_GII:Extension_Reading_length_failed___n
jmp 0x140040be0
movzx edx, byte [rsp + 0x40]
movzx r8d, word [rsp + 0x4c]
test dl, dl
jns 0x140040c55
mov sil, 1
rol r8w, 8
mov word [rsp + 0x4c], r8w
and dl, 0x7f
mov byte [rsp + 0x40], dl
movzx r9d, dl
mov ecx, r9d
test dl, dl
je 0x1400412b9
sub ecx, 1
je 0x140041201
sub ecx, 1
je 0x140040cf9
cmp ecx, 1
je 0x140040ca3
lea r8, str.vncClientThread::run_:_GII:_Extension_invalid_subtype:__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
mov rax, qword [rbx + 0x2b8]
xor edx, edx
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], dl
jne 0x140040cda
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3cb], 0
jne 0x140040d31
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1bc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1cc], xmm1
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1ec], r13
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x309
lea rcx, [rbp + 0x48]
call fcn.140019d90
nop
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIDeviceCreation__n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov byte [rbp + 0x1b8], 0xfd
movzx eax, byte [rsp + 0x40]
mov byte [rbp + 0x1b9], al
movzx eax, word [rsp + 0x4c]
mov word [rbp + 0x1ba], ax
mov r8d, gethostname
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x140040df3
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
lea rcx, [rbp + 0x48]
call fcn.140019dc0
jmp 0x140041924
test sil, sil
je 0x140040f26
mov ecx, dword [rbp + 0x1e0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e0], edx
mov ecx, dword [rbp + 0x1e4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e4], edx
mov ecx, dword [rbp + 0x1e8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1e8], edx
mov ecx, dword [rbp + 0x1ec]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x1ec], r8d
mov ecx, dword [rbp + 0x1f0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x1f0], edx
mov ecx, dword [rbp + 0x1dc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
bswap edx
mov dword [rbp + 0x1dc], edx
jmp 0x140040f2d
mov r8d, dword [rbp + 0x1ec]
lea eax, [r8 - 1]
cmp eax, 9
ja 0x1400411f5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], eax
mov edi, r13d
test r8d, r8d
je 0x140040de5
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, [rbp + 0x250]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400411e9
test sil, sil
je 0x14004115c
mov ecx, dword [rbp + 0x250]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x250], edx
mov ecx, dword [rbp + 0x2a4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a4], edx
mov ecx, dword [rbp + 0x2a8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2a8], edx
mov ecx, dword [rbp + 0x2ac]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2ac], edx
mov ecx, dword [rbp + 0x2b0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b0], edx
mov ecx, dword [rbp + 0x2b4]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b4], edx
mov ecx, dword [rbp + 0x2b8]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2b8], edx
mov ecx, dword [rbp + 0x2bc]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2bc], edx
mov ecx, dword [rbp + 0x2c0]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x2c0], edx
mov dword [rbp - 0x80], 0x40082fd
mov dword [rbp - 0x7c], 0x1000000
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r8d, 8
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008af60
test eax, eax
je 0x1400411dd
mov edx, r12d
mov ecx, dword [rbp + 0x1f0]
call qword [rbx + 0x2e0]
mov ecx, dword [rbp + 0x1f0]
mov dword [rbx + 0x2f0], ecx
lea eax, [rcx - 1]
cmp eax, 0xfc
ja 0x1400411ca
call fcn.140147b5c
mov qword [rbx + 0x2e8], rax
inc edi
cmp edi, dword [rbp + 0x1ec]
jb 0x140040f82
jmp 0x140040de5
lea r8, str.vncClientThread::run_:_GIIExtension_writing_device_creation_failed_n
jmp 0x140040dc9
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation_valuators_failed_n
jmp 0x140040dc9
lea r8, str.vncClientThread::run_:_GIIExtension_reading_device_creation__invalid_amount_of_valuators_n
jmp 0x140040dc9
mov rax, qword [rbx + 0x2b8]
lea rcx, vtable.VNCLog.0
cmp byte [rax + 0x3cb], 0
je 0x1400440c8
mov word [rsp + 0x54], r13w
lea r8, str.vncClientThread::run_:_GII:_Get_Subtype__rfbGIIVersionMessage__n
mov edx, 9
call fcn.140018d00
cmp word [rsp + 0x4c], di
je 0x14004124c
movzx r9d, word [rsp + 0x54]
lea r8, str.vncClientThread::run_:_GII:Extension_invalid_length:__d_n
jmp 0x140040c82
mov r8d, edi
lea rdx, [rsp + 0x54]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x14004128c
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_version_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
movzx eax, word [rsp + 0x54]
test sil, sil
je 0x14004129f
rol ax, 8
mov word [rsp + 0x54], ax
cmp ax, 1
je 0x140041924
movzx r9d, ax
lea r8, str.vncClientThread::run_:_GII:_Extension_client_version_invalid_number:__d_n
jmp 0x140040c82
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3cb], 0
jne 0x1400412f1
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
jmp 0x140041924
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov byte [rbp + 0x188], 0xfd
mov byte [rbp + 0x189], dl
mov word [rbp + 0x18a], r8w
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x18c]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x140041337
lea r8, str.vncClientThread::run_:_GIIExtension_reading_client_creation_failed_n
jmp 0x1400412d0
test sil, sil
je 0x1400413e0
rol word [rbp + 0x18e], 8
mov ecx, dword [rbp + 0x190]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x190], edx
mov ecx, dword [rbp + 0x194]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov dword [rbp + 0x194], r8d
mov ecx, dword [rbp + 0x198]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x198], edx
jmp 0x1400413e7
mov r8d, dword [rbp + 0x194]
mov ecx, r8d
mov eax, 0x20
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140147b5c
mov r15, rax
mov r14d, r13d
cmp dword [rbp + 0x194], r13d
jbe 0x1400417f1
lea r12d, [rdi + 5]
nop dword [rax]
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x78], r13d
mov qword [rbp + 0x168], r13
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
test sil, sil
je 0x140041492
mov ecx, dword [rsp + 0x48]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x48], edx
mov r8d, r12d
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
test sil, sil
je 0x1400414e1
mov ecx, dword [rsp + 0x58]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x58], edx
jmp 0x1400414e5
mov edx, dword [rsp + 0x58]
mov edi, r14d
shl rdi, 5
add rdi, r15
mov dword [rdi], edx
mov r8d, r12d
lea rdx, [rsp + 0x5c]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
test sil, sil
je 0x140041540
mov ecx, dword [rsp + 0x5c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x5c], edx
jmp 0x140041544
mov edx, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x48]
test r9b, 0x10
je 0x1400417be
mov eax, edx
shr eax, 0x10
mov dword [rdi + 0xc], eax
movzx eax, dx
mov dword [rdi + 0x10], eax
bt r9d, 0x1c
jae 0x1400415d3
mov r8d, r12d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
test sil, sil
je 0x1400415c2
mov ecx, dword [rsp + 0x60]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x60], edx
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x1400415d9
mov edx, dword [rsp + 0x60]
movzx eax, dx
shr edx, 0x10
mov r9d, dword [rsp + 0x48]
jmp 0x1400415d9
mov eax, r12d
mov edx, r12d
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], eax
bt r9d, 0x19
jae 0x140041607
mov r8d, r12d
lea rdx, [rsp + 0x64]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140041638
mov ecx, dword [rsp + 0x64]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x64], edx
bt r9d, 0x18
jae 0x140041660
mov r8d, r12d
lea rdx, [rsp + 0x78]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140041691
mov ecx, dword [rsp + 0x78]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsp + 0x78], edx
bt r9d, 0x17
jae 0x1400416be
mov r8d, 8
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400417c7
mov r9d, dword [rsp + 0x48]
test sil, sil
je 0x140041758
mov rdx, qword [rbp + 0x168]
mov r8, rdx
movabs rax, 0xff000000000000
and r8, rax
mov rax, rdx
shr rax, 0x10
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff0000000000
and rax, rcx
or r8, rax
shr r8, 0x10
mov rax, rdx
movabs rcx, 0xff00000000
and rax, rcx
or r8, rax
shr r8, 8
mov rcx, rdx
shl rcx, 0x10
mov rax, rdx
and eax, 0xff00
or rcx, rax
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
mov eax, 0xff000000
and rdx, rax
or rcx, rdx
shl rcx, 8
or r8, rcx
mov qword [rbp + 0x168], r8
mov dword [rdi + 4], r13d
mov eax, dword [rdi]
cmp eax, dword [rbx + 0x2f0]
jae 0x1400417a9
mov ecx, eax
test r9d, r9d
jns 0x140041797
mov rax, qword [rbx + 0x2e8]
cmp byte [rcx + rax], 1
jne 0x140041783
mov dword [rdi + 4], 0x20006
jmp 0x1400417a9
mov dword [rdi + 4], 0x10006
mov rax, qword [rbx + 0x2e8]
mov byte [rcx + rax], 1
jmp 0x1400417a9
mov dword [rdi + 4], 0x40000
mov rax, qword [rbx + 0x2e8]
mov byte [rcx + rax], 0
mov dword [rdi + 0x1c], r13d
inc r14d
cmp r14d, dword [rbp + 0x194]
jae 0x1400417ea
jmp 0x140041420
lea r8, str.vncClientThread::run_:_Only_16_bit_XT_supported_n
jmp 0x1400417ce
lea r8, str.vncClientThread::run_:_GIIExtension_reading_TouchINfo_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rdi, 0xffffffffffffffff
mov eax, dword [rbp + 0x194]
cmp eax, 0xfe
ja 0x14004191b
mov ecx, eax
mov eax, 0x90
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140147b5c
mov rsi, rax
mov ecx, dword [rbp + 0x194]
lea r8, [rcx + rcx*8]
shl r8, 4
xor edx, edx
mov rcx, rax
call fcn.14014a5c0
mov edi, r13d
mov ecx, dword [rbp + 0x194]
test ecx, ecx
je 0x14004190a
mov ebx, 2
nop dword [rax]
mov ecx, edi
lea r11, [rcx + rcx*8]
shl r11, 4
add r11, rsi
mov dword [r11], ebx
shl rcx, 5
lea r10, [rcx + r15]
mov r9d, dword [r10 + 0xc]
mov dword [r11 + 0x20], r9d
mov r8d, dword [r10 + 0x10]
mov dword [r11 + 0x24], r8d
mov eax, dword [r10 + 0x1c]
mov dword [r11 + 0x40], eax
mov dword [r11 + 0x60], r13d
mov eax, 7
mov dword [r11 + 0x64], eax
mov dword [r11 + 0x88], 0x5a
mov dword [r11 + 0x8c], 0x7d00
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ecx, r8d
sub ecx, eax
mov dword [r11 + 0x6c], ecx
mov eax, dword [r10 + 0x18]
cdq
sub eax, edx
sar eax, 1
add eax, r8d
mov dword [r11 + 0x74], eax
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
mov ecx, r9d
sub ecx, eax
mov dword [r11 + 0x68], ecx
mov eax, dword [r10 + 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, r9d
mov dword [r11 + 0x70], eax
mov eax, dword [r10]
mov dword [r11 + 4], eax
mov eax, dword [r10 + 4]
mov dword [r11 + 0xc], eax
inc edi
mov ecx, dword [rbp + 0x194]
cmp edi, ecx
jb 0x140041850
mov rbx, qword [rbp + 0x20]
mov rdx, rsi
call qword [rbx + 0x2d8]
mov rcx, rsi
call fcn.140147b10
mov rcx, r15
call fcn.140147b10
nop
lea rcx, [rbp - 0x20]
call fcn.140019dc0
jmp 0x14004198e
mov r8d, 0xa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
movsd xmm0, qword [rbp + 0x140]
movsd qword [rbp - 0x10], xmm0
movzx eax, word [rbp + 0x148]
mov word [rbp - 8], ax
lea rdx, [rbp - 0x10]
mov rcx, qword [rbx + 0x2b8]
call fcn.1400454b0
test al, al
jne 0x14004198e
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rcx, qword [0x14022a710]
call fcn.140039b90
test eax, eax
je 0x1400419aa
mov rcx, qword [rbx + 0x2b8]
call fcn.140049280
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x118], 0
je 0x140044100
movzx r12d, byte [rsp + 0x43]
movzx edi, byte [rsp + 0x44]
movzx esi, byte [rsp + 0x45]
movzx r14d, byte [rsp + 0x46]
movzx r15d, byte [rsp + 0x47]
jmp 0x14003fe30
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x140041b8c
cmp byte [0x14021f65a], 0
je 0x140041b1e
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp + 0x144], edx
cmp byte [rbp + 0x141], 0
je 0x140041b8c
lea r8d, [rdx - 0x61]
cmp r8d, 0x63
ja 0x140041b8c
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rdx, qword [rcx + 0x90]
movsxd rax, r8d
imul rcx, rax, 0x64
mov rax, qword [rdx + 0xe440]
mov ecx, dword [rcx + rax]
mov dword [0x14021f65c], ecx
lea r8, str.GlobalSessionEventUltraPreConnect
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rsi, rax
lea r8, str.GlobalSessionUltraPreConnect
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
je 0x140041af2
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140041ae9
mov ecx, dword [0x14021f65c]
mov dword [rax], ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140041b8c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2b8]
call fcn.140047db0
jmp 0x14004198e
mov r8, qword [rbx + 0x2b8]
cmp byte [r8 + 0x3c9], 0
je 0x140041b8c
mov edx, dword [rbp + 0x144]
mov ecx, edx
and ecx, 0xff0000
mov eax, edx
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shl eax, 8
or ecx, eax
mov dword [rbp + 0x144], ecx
cmp byte [rbp + 0x141], 0
setne dl
movzx r9d, byte [r8 + 0x3cd]
movzx r8d, byte [r8 + 0x3cc]
call fcn.140077500
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x5ac], r12d
mov rcx, qword [rbx + 0x2b8]
call fcn.140047db0
jmp 0x14004198e
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x14004198e
cmp byte [0x14021f65a], 0
jne 0x14004198e
mov r8, qword [rbx + 0x2b8]
cmp byte [r8 + 0x3ca], 0
je 0x14004198e
movzx eax, word [rbp + 0x142]
rol ax, 8
mov word [rbp + 0x142], ax
movzx ecx, word [rbp + 0x144]
rol cx, 8
mov word [rbp + 0x144], cx
movzx eax, ax
movzx edx, word [r8 + 0x850]
imul edx, eax
mov word [rbp + 0x142], dx
movzx eax, word [r8 + 0x850]
movzx r9d, cx
imul r9d, eax
mov word [rbp + 0x144], r9w
mov r14d, 0x8000
cmp dx, word [r8 + 0x536]
jne 0x140041c53
cmp r9w, word [r8 + 0x538]
je 0x140041c59
mov r14d, 0x8001
movzx ecx, byte [rbp + 0x141]
movzx eax, cl
xor al, byte [r8 + 0x535]
test r12b, al
je 0x140041ca3
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movzx ecx, byte [rbp + 0x141]
test eax, eax
movzx eax, cl
not al
je 0x140041c96
and eax, r12d
lea eax, [rax*8 + 8]
jmp 0x140041ca0
and eax, r12d
lea eax, [rax*2 + 2]
or r14d, eax
mov rax, qword [rbx + 0x2b8]
movzx r8d, byte [rax + 0x535]
movzx edx, cl
and dl, 2
movzx eax, r8b
and al, 2
cmp dl, al
je 0x140041cd4
mov eax, 0x40
test dl, dl
mov edx, 0x20
cmovne eax, edx
or r14d, eax
xor r8b, cl
test r8b, 4
je 0x140041d20
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 4
test eax, eax
je 0x140041d07
test byte [rbp + 0x141], dil
mov eax, edi
mov ecx, 2
cmovne eax, ecx
or r14d, eax
jmp 0x140041d25
test byte [rbp + 0x141], 4
mov eax, reloc.WS2_32.dll_recv
mov ecx, 8
cmovne eax, ecx
or r14d, eax
jmp 0x140041d25
mov edi, 4
mov rcx, qword [0x14022a710]
call fcn.140039ba0
test eax, eax
je 0x140041e3e
mov rcx, qword [rbx + 0x2b8]
movzx edx, byte [rcx + 0x535]
movzx eax, dl
movzx r8d, byte [rbp + 0x141]
xor al, r8b
test r12b, al
jne 0x140041d62
xor dl, r8b
test dl, 2
je 0x140041d89
cmp byte [rcx + 0x3b8], 0
jne 0x140041e3e
mov byte [rcx + 0x3ad], r12b
mov rcx, qword [rbx + 0x2b0]
call fcn.140088b70
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3b8], 0
jne 0x140041e3e
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, dword [rdi + 0x38c]
add r14d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r14d, ecx
sub r14d, eax
mov rcx, qword [0x14022a710]
call fcn.140039bd0
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140041e1f
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r14d, word [rbp + 0x144]
add r14d, dword [rax + 0x384]
mov rcx, qword [rax + 0x3c0]
test rcx, rcx
je 0x14004198e
mov r8d, r14d
mov edx, esi
call fcn.140024020
jmp 0x14004198e
mov r12d, r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x3e0
call fcn.140039320
movzx ecx, byte [rbp + 0x141]
test eax, eax
je 0x140041e8c
mov rax, qword [rbx + 0x2b8]
test cl, 8
je 0x140041e7c
test byte [rax + 0x535], 8
jne 0x140041e7c
mov r12d, 0x78
jmp 0x140041eac
test cl, 0x10
je 0x140041eb1
test byte [rax + 0x535], 0x10
jne 0x140041eb1
jmp 0x140041ea6
movzx eax, cl
and al, 8
je 0x140041e98
bts r14d, 0xb
neg al
sbb r12d, r12d
and r12d, 0x78
test cl, 0x10
je 0x140041eb1
mov r12d, 0xffffff88
bts r14d, 0xb
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x48]
call qword [rax + 0x1c0]
mov r8, qword [rbx + 0x2b8]
cmp dword [r8 + 0x390], 0
je 0x140041f53
movzx eax, word [rbp + 0x142]
mov ecx, dword [r8 + 0x380]
add ecx, eax
imul eax, ecx, 0xffff
mov ecx, dword [rbp - 0x48]
dec ecx
cdq
idiv ecx
mov esi, eax
movzx ecx, word [rbp + 0x144]
mov edx, dword [r8 + 0x384]
add edx, ecx
imul eax, edx, 0xffff
mov r8d, dword [rbp - 0x68]
dec r8d
cdq
idiv r8d
mov edi, eax
mov rcx, qword [rbx + 0x2b0]
call fcn.140087ae0
neg eax
sbb rdx, rdx
and edx, 0x564e4300
mov qword [rsp + 0x20], rdx
mov r9d, r12d
mov r8d, edi
mov edx, esi
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x140042188
lea rcx, [r8 + 0x998]
call fcn.14002a200
test al, al
je 0x14004208d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
mov rdi, qword [rbx + 0x2b8]
lea ecx, [rax + 0x4c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [rdi + 0x388]
add esi, dword [rdi + 0x380]
movzx ecx, word [rbp + 0x142]
add esi, ecx
sub esi, eax
mov rdi, qword [rbx + 0x2b8]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, dword [rdi + 0x38c]
add r15d, dword [rdi + 0x384]
movzx ecx, word [rbp + 0x144]
add r15d, ecx
sub r15d, eax
mov rcx, qword [0x14022a710]
call fcn.140039bd0
test eax, eax
je 0x140041fff
mov rax, qword [rbx + 0x2b8]
movzx esi, word [rbp + 0x142]
add esi, dword [rax + 0x380]
movzx r15d, word [rbp + 0x144]
add r15d, dword [rax + 0x384]
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, esi, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x60], eax
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rax - 1]
imul eax, r15d, 0xffff
cdq
idiv ecx
mov dword [rbp + 0x64], eax
bts r14d, 0xe
mov dword [rbp + 0x6c], r14d
mov rcx, qword [rbx + 0x2b0]
call fcn.140087ae0
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x68], r12d
mov dword [rbp + 0x70], r13d
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x998
call fcn.14004a130
mov r8d, 0x28
lea rdx, [rbp + 0x58]
mov r12d, 1
mov ecx, r12d
call rax
jmp 0x14004218e
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x6c], r13d
mov dword [rbp - 0x64], 0xa
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov dword [rbp + 0x2e8], eax
test r14b, 1
je 0x14004211d
btr r14d, 0xf
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x70]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov qword [rbp + 0x2d0], 0xa
mov dword [rbp + 0x2d8], r13d
xor r9d, r9d
lea r8, [rbp - 0x64]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rbp + 0x2d0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov rcx, qword [rbx + 0x2b0]
call fcn.140087ae0
neg eax
sbb rcx, rcx
and ecx, 0x564e4300
movzx r8d, word [rbp + 0x144]
sub r8d, dword [rbp - 0x2c]
movzx edx, word [rbp + 0x142]
sub edx, dword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov ecx, r14d
call qword [sym.imp.USER32.dll_mouse_event]
test r14b, 1
je 0x140042188
xor r9d, r9d
lea r8, [rbp + 0x2e0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
lea r8, [rsp + 0x6c]
xor edx, edx
lea ecx, [rdx + 0x71]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r12d, 1
mov rcx, qword [rbx + 0x2b8]
mov eax, dword [rbp + 0x140]
mov dword [rcx + 0x534], eax
movzx eax, word [rbp + 0x144]
mov word [rcx + 0x538], ax
jmp 0x140041b7e
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x14004198e
mov ecx, dword [rbp + 0x144]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x6400000
jg 0x14004198e
test edi, edi
jns 0x140042362
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x5b0], 0
je 0x14004198e
mov eax, edi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
cmp edi, 0x6400000
ja 0x14004198e
lea rcx, [rbp]
call fcn.140015380
nop
xor r8d, r8d
mov edx, edi
lea rcx, [rbp]
call fcn.1400153e0
lea rcx, [rbp]
call fcn.1400153d0
mov rdx, rax
mov r8d, edi
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x140042289
lea rcx, [rbp]
call fcn.1400153c0
jmp 0x14004198e
lea rcx, [rbp]
call fcn.140015490
mov ecx, 0xff000000
and eax, ecx
bt eax, 0x18
jb 0x140042339
cmp eax, 0x1000000
je 0x140042339
lea ecx, [rax - 0x2000000]
test ecx, 0xfdffffff
je 0x1400422e4
cmp eax, 0x10000000
jne 0x140042354
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2b8]
lea rdx, [rbp]
call qword [rax + 0x158]
jmp 0x140042354
lea rcx, [rbp + 0x1b8]
call fcn.1400158e0
nop
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.140015950
test al, al
je 0x14004232b
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
lea rcx, [rbp]
call fcn.140015490
mov r8d, eax
lea rdx, [rbp + 0x1b8]
mov rcx, qword [rbx + 0x2b8]
call qword [rdi + 0x28]
nop
lea rcx, [rbp + 0x1b8]
call fcn.140015900
jmp 0x140042354
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x5b0
mov r8b, 1
lea rdx, [rbp]
call fcn.140015710
nop
lea rcx, [rbp]
call fcn.1400153c0
jmp 0x14004198e
movsxd rcx, edi
inc rcx
call fcn.140147b5c
mov r14, rax
movsxd rcx, edi
mov byte [rcx + rax], 0
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
jne 0x14004239a
mov rcx, r14
call fcn.140147b10
jmp 0x14004198e
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1400423a1
lea eax, [rdi + rdi]
movsxd rcx, eax
inc rcx
call fcn.140147b5c
mov rsi, rax
mov rcx, r13
movsxd rax, edi
test edi, edi
jle 0x1400423f4
mov rdx, r14
nop dword [rax]
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x1400423e5
mov byte [rsi + rcx], reloc.WS2_32.dll_listen
inc rcx
movzx r8d, byte [rdx]
mov byte [rsi + rcx], r8b
inc rcx
inc rdx
sub rax, r12
jne 0x1400423d0
mov byte [rsi + rcx], 0
mov rcx, r14
call fcn.140147b10
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x5e0
mov rdx, rsi
call fcn.140016f10
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x150]
mov rcx, rsi
call fcn.140147b10
jmp 0x14004198e
mov rcx, qword [rbx + 0x2b0]
call fcn.140085b00
test al, al
jne case.0x1400400a2.8
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x859], r12b
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x859], 0
je 0x14004248e
call fcn.14008b150
test eax, eax
jne 0x14004249b
jmp case.0x1400400a2.1
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
mov rcx, qword [rbx + 0x2b0]
call fcn.140085b00
cmp al, r12b
je 0x14004198e
movzx ecx, byte [rbp + 0x141]
lea eax, [rcx - 1]
cmp al, 8
ja 0x14004198e
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x854], ecx
movzx ecx, byte [rbp + 0x141]
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x850], ecx
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x57
lea rcx, [rbp + 0x80]
call fcn.140019d90
nop
movzx edx, byte [rbp + 0x141]
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x4b0]
call fcn.140035e00
mov rcx, qword [rbx + 0x2b8]
test eax, eax
jne 0x140042542
mov byte [rcx + 0x118], al
lea rcx, [rbp + 0x80]
call fcn.140019dc0
jmp 0x14004198e
mov byte [rcx + 0x858], 1
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe434]
cdq
idiv ecx
mov dword [r8 + 0xe434], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe438]
cdq
idiv ecx
mov dword [r8 + 0xe438], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe42c]
cdq
idiv ecx
mov dword [r8 + 0xe42c], eax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8, qword [rcx + 0x90]
movzx ecx, byte [rbp + 0x141]
mov eax, dword [r8 + 0xe430]
cdq
idiv ecx
mov dword [r8 + 0xe430], eax
mov r8d, r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x2b8]
call fcn.140045a00
nop
lea rcx, [rbp + 0x80]
call fcn.140019dc0
jmp 0x14004198e
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
mov rax, qword [rbx + 0x2b8]
je 0x140041987
mov byte [rax + 0x9ca], r12b
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3c9], 0
je 0x14004198e
lea r9, str.enabled
cmp byte [rbp + 0x141], r12b
lea rax, str.disabled
cmove r9, rax
lea r8, str.vncClientThread::run_:_rfbSetServerInput:_inputs__s_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140038100
test al, al
jne 0x1400426fa
cmp byte [rbp + 0x141], r12b
jne 0x1400426fa
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
movzx edx, r12b
mov rcx, qword [rcx + 0x90]
call fcn.140051240
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], r12b
jmp 0x14004198e
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140038100
test al, al
je 0x14004272f
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], 0
je 0x14004272f
cmp byte [rbp + 0x141], 0
je 0x14004276e
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xd0]
mov rcx, rax
call fcn.140038100
test al, al
jne 0x14004198e
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], al
jne 0x14004198e
cmp byte [rbp + 0x141], al
jne 0x14004198e
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.140051240
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], 0
jmp 0x14004198e
mov r8d, 8
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
lea rcx, [rbp - 0x78]
call fcn.14004a090
nop
mov esi, r13d
mov r14d, r13d
cmp byte [rbp + 0x146], r13b
jbe 0x1400428fa
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x168]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400428ec
movzx eax, word [rbp + 0x16c]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x54], eax
movzx eax, word [rbp + 0x16e]
rol ax, 8
movzx eax, ax
mov dword [rbp - 0x58], eax
movzx eax, word [rbp + 0x170]
rol ax, 8
movzx r8d, ax
mov dword [rbp - 0x5c], r8d
movzx eax, word [rbp + 0x172]
rol ax, 8
movzx edx, ax
mov dword [rbp - 0x60], edx
mov ecx, dword [rbp + 0x174]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
imul edx, r8d
cmp edx, 0xc00000
jg 0x1400428d7
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x5c]
lea rcx, [rbp + 0x118]
call fcn.14004a420
mov rdi, rax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xe0]
call fcn.14004a420
mov rdx, rax
mov r8, rdi
lea rcx, [rbp + 0x120]
call fcn.14004a430
mov r8, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.14004a450
inc r14d
movzx eax, byte [rbp + 0x146]
cmp r14d, eax
jl 0x1400427e0
jmp 0x1400428fa
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
mov rax, qword [rbx + 0x2b0]
mov edi, r13d
cmp dword [rax + 0xd4], r13d
cmovne edi, esi
cmp edi, 3
sete cl
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x4d8], cl
mov rcx, qword [rbx + 0x2b0]
cmp qword [rcx + 0xd8], 0
je 0x14004296a
call fcn.140085b00
test al, al
jne 0x14004296a
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x108]
call fcn.1400348c0
mov r9, qword [rbx + 0x2b8]
lea r8, [r9 + 0xc]
movsx r10d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r10d
jmp 0x1400429c1
mov rcx, qword [rbx + 0x2b0]
cmp qword [rcx + 0xd8], 0
je 0x1400429e1
call fcn.140085b00
test al, al
je 0x1400429e1
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x4d8], 0
je 0x1400429e1
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xe8]
call fcn.1400348c0
mov r9, qword [rbx + 0x2b8]
lea rdx, [r9 + 0xc]
movsx r8d, word [r9 + 0x3d4]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r8d
mov rcx, qword [rbx + 0x2b0]
movzx r9d, byte [r9 + 0x4d8]
mov r8, rax
mov edx, edi
mov rcx, qword [rcx + 0xd8]
call fcn.140033cb0
mov rcx, qword [rbx + 0x2b8]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax + 0xc], 0
jne 0x1400429f0
test rax, rax
jne 0x140042a05
mov byte [rcx + 0x4d8], al
lea rcx, [rbp - 0x78]
call fcn.140033450
jmp 0x14004198e
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x14004198e
movzx edx, byte [rbp + 0x141]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.1400509c0
jmp 0x14004198e
mov r8d, 6
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
movzx r10d, word [rbp + 0x142]
rol r10w, 8
movzx edx, word [rbp + 0x144]
cmp r10w, 5
jae 0x140042ad8
movzx eax, dx
rol ax, 8
cmp ax, 5
jae 0x140042ad8
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x4b0]
mov r8d, r12d
mov edx, r12d
mov rcx, qword [rcx + 0x90]
call fcn.1400509e0
jmp 0x14004198e
mov r9, qword [rbx + 0x2b8]
mov ecx, dword [r9 + 0x850]
rol dx, 8
movzx r8d, dx
add r8d, dword [r9 + 0x38c]
add r8d, dword [r9 + 0x384]
imul r8d, ecx
mov edx, dword [r9 + 0x388]
add edx, dword [r9 + 0x380]
movzx eax, r10w
add edx, eax
imul edx, ecx
mov rcx, qword [r9 + 0x4b0]
mov rcx, qword [rcx + 0x90]
call fcn.1400509e0
jmp 0x14004198e
mov rcx, qword [rbx + 0x2b8]
mov edx, edi
mov rcx, qword [rcx + 0x880]
call fcn.14002d4e0
jmp 0x14004198e
movzx r14d, r12b
mov rcx, qword [0x14022a710]
call fcn.140039b90
test eax, eax
je 0x140042b6d
mov rcx, qword [rbx + 0x2b8]
call fcn.140048ff0
movzx r14d, al
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x3c9], 0
je 0x140042b86
cmp byte [rcx + 0x3ca], 0
jne 0x140042b89
xor r14b, r14b
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x58
lea rcx, [rbp + 0x90]
call fcn.140019d90
nop
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x67c], r12d
mov r8d, reloc.WS2_32.dll_inet_ntoa
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x140043fd7
movzx eax, byte [rbp + 0x141]
dec eax
cmp eax, 0xf
ja case.0x140042bfa.2
cdqe
mov ecx, dword [rsi + rax*4 + 0x445c8]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80e], 1
jmp case.0x140042bfa.2
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80e], 0
jmp case.0x140042bfa.2
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, rax
mov r8d, 0x59
lea rcx, [rbp - 0x40]
call fcn.140019d90
nop
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je 0x1400432a3
test r14b, r14b
je 0x1400432a3
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
xor edx, edx
mov r8d, 0x144
call fcn.14014a5c0
cmp edi, 0x138
ja 0x1400432a3
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
mov r8d, edi
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400432a3
mov ecx, dword [rbp + 0x144]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
mov dword [rsp + 0x70], r13d
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je 0x1400432a3
mov ecx, dword [rsp + 0x70]
mov r14d, ecx
and r14d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r14d, eax
shr r14d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r14d, eax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
mov edx, 0x2c
call fcn.1400380d0
mov r15, rax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7cc
test rax, rax
jne 0x140042d82
mov byte [rcx], al
jmp 0x140042d8f
lea rdx, [rax + 1]
call fcn.14004a570
mov byte [r15], 0
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
lea rcx, [rbp + 0x188]
call fcn.140039be0
mov rcx, rax
call fcn.140021cd0
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
call fcn.14004a580
lea rcx, [rbp + 0x188]
call fcn.140016f30
mov r12d, r13d
lea eax, [rdi + 0x41]
mov edi, eax
mov ecx, eax
call fcn.140147b5c
mov r15, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.14014a5c0
mov r8, qword [rbx + 0x2b8]
add r8, 0x688
mov edx, edi
mov rcx, r15
call fcn.140150800
mov edx, 0x5c
mov rcx, r15
call fcn.1400380d0
mov byte [rax], r12b
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDiskFreeSpaceExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140042e5e
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x28]
mov rcx, r15
call rax
test eax, eax
mov eax, 0xffffffff
cmove r12d, eax
mov rcx, r15
call fcn.140147b10
mov r8, qword [rbp + 0x28]
sar r8, 0xa
mov ecx, r14d
shl rcx, 0x20
mov eax, esi
add rcx, rax
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, r8d
cmp rax, rdx
mov esi, 0xffffffff
cmovl r12d, esi
mov ecx, 0x2400
call fcn.140147b5c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e0], rax
mov rax, qword [rbx + 0x2b8]
cmp qword [rax + 0x7e0], 0
cmove r12d, esi
mov ecx, 0x2000
call fcn.140147b5c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e8], rax
mov rcx, qword [rbx + 0x2b8]
cmp qword [rcx + 0x7e8], 0
cmove r12d, esi
xor eax, eax
mov qword [rbp + 0x178], rax
mov dword [rbp + 0x180], eax
mov byte [rbp + 0x178], 7
cmp r12d, esi
je 0x14004309a
mov rax, qword [rcx + 0x110]
test rax, rax
je 0x140042f35
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x688
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov eax, 4
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7f0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov rcx, qword [rbx + 0x2b8]
mov rdx, qword [rcx + 0x7f0]
mov edi, esi
cmp rdx, 0xffffffffffffffff
cmovne edi, r13d
mov r12d, edi
test al, al
je 0x14004309a
cmp rdx, 0xffffffffffffffff
je 0x14004309a
lea rdx, [rcx + 0x688]
lea r8, [rbp + 0x30]
call fcn.140048f50
test al, al
je 0x14004309a
mov rax, qword [rbp + 0x30]
shr rax, 0xd
lea esi, [rax*4 + 0x400]
movsxd rcx, esi
call fcn.140147b5c
mov r15, rax
mov rcx, qword [rbx + 0x2b8]
mov r9d, esi
mov r8, rax
mov rdx, qword [rcx + 0x7f0]
call fcn.140047de0
mov r14d, eax
cmp eax, 0xffffffff
je 0x140043095
mov byte [rbp + 0x179], reloc.WS2_32.dll_inet_ntoa
mov edx, esi
shl edx, 0x10
mov ecx, esi
and ecx, 0xff00
or edx, ecx
shl edx, 8
mov ecx, esi
sar ecx, 8
and ecx, 0xff00
or edx, ecx
shr esi, 0x18
or edx, esi
mov dword [rbp + 0x17c], edx
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r14d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r14d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x180], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx + 0x2a8]
call fcn.14008af60
mov rcx, r15
call fcn.140147b10
mov esi, 0xffffffff
mov byte [rbp + 0x179], 9
mov eax, r12d
bswap eax
mov dword [rbp + 0x17c], eax
mov rax, qword [rbx + 0x2b8]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400430c0
shr rcx, 0x18
movzx edx, cl
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x1400430e0
shl rcx, 8
and ecx, 0xff0000
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140043100
shr rcx, 8
and ecx, 0xff00
or edx, ecx
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx + 0x688], 0
jne 0x140043120
shl rcx, 0x18
or edx, ecx
mov dword [rbp + 0x180], edx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x178]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov rdx, qword [rbx + 0x2b8]
add rdx, 0x688
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140043166
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
mov r8, qword [rbx + 0x2b8]
cmp r12d, esi
jne 0x1400431e9
lea rcx, [r8 + 0x7f0]
call fcn.14008b4a0
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e8]
test rcx, rcx
je 0x1400431c1
call fcn.140147b10
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e8], r13
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je 0x1400432a3
call fcn.140147b10
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e0], r13
jmp 0x1400432a3
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8 + 0x7f8], edx
mov rcx, qword [rbx + 0x2b8]
mov eax, dword [rcx + 0x7f8]
shr eax, 0xd
mov dword [rcx + 0x7fc], eax
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x800], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x804], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80c], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 1
mov rcx, qword [0x14022a710]
call fcn.140039bc0
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.14008aae0
nop
lea rcx, [rbp - 0x40]
call fcn.140019dc0
jmp case.0x140042bfa.2
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0xa0], xmm0
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0xb0], eax
movzx r8d, r14b
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbx + 0x2b8]
call fcn.140049730
jmp case.0x140042bfa.2
mov rcx, qword [0x14022a710]
call fcn.140039bc0
imul edx, eax, 0x3e8
mov rcx, qword [rbx + 0x2a8]
call fcn.14008aa60
mov ecx, dword [rbp + 0x148]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
call fcn.140047ec0
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
jmp case.0x140042bfa.2
mov ecx, dword [rbp + 0x144]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov eax, 0xffffffff
cmp edx, eax
jne 0x1400433c7
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.14008b4a0
jmp case.0x140042bfa.2
mov ecx, 0x2000
call fcn.140147b5c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e0], rax
mov rcx, qword [rbx + 0x2b8]
cmp qword [rcx + 0x7e0], 0
jne 0x140043401
add rcx, 0x810
call fcn.14008b4a0
jmp case.0x140042bfa.2
mov ecx, 0x2400
call fcn.140147b5c
mov rcx, qword [rbx + 0x2b8]
mov qword [rcx + 0x7e8], rax
mov rax, qword [rbx + 0x2b8]
cmp qword [rax + 0x7e8], 0
jne 0x140043465
lea rcx, [rax + 0x810]
call fcn.14008b4a0
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + 0x7e0]
test rcx, rcx
je case.0x140042bfa.2
call fcn.140147b10
mov rax, qword [rbx + 0x2b8]
mov qword [rax + 0x7e0], r13
jmp case.0x140042bfa.2
mov byte [rax + 0x818], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x81c], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x808], r13d
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x824], r13d
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x829], 0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 0
mov rcx, qword [rbx + 0x2b8]
call fcn.140048540
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
jmp case.0x140042bfa.2
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
mov ecx, dword [rbp + 0x144]
mov r8d, ecx
and r8d, 0xff0000
mov eax, ecx
shr eax, 0x10
or r8d, eax
shr r8d, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or r8d, eax
mov ecx, dword [rbp + 0x148]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
shr edx, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edx, eax
mov rcx, qword [rbx + 0x2b8]
call fcn.140047f40
mov rcx, qword [rbx + 0x2b8]
mov byte [rcx + 0x118], al
xor edx, edx
mov rcx, qword [rbx + 0x2b8]
call fcn.140049460
jmp case.0x140042bfa.2
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x80d], 0
je case.0x140042bfa.2
call fcn.140048090
jmp case.0x140042bfa.2
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x1400435f1
mov byte [rax + 0x80c], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 1
mov rcx, qword [rbx + 0x2b8]
call fcn.140048090
jmp case.0x140042bfa.2
cmp byte [rax + 0x82a], 0
je 0x140043614
mov byte [rax + 0x829], 1
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80f], 1
jmp case.0x140042bfa.2
mov byte [rax + 0x85a], 1
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x85a], 0
je case.0x140042bfa.2
xor eax, eax
mov qword [rbp + 0x1a8], rax
mov dword [rbp + 0x1b0], eax
mov byte [rbp + 0x1a8], 7
cmp word [rbp + 0x142], ax
jne 0x140043696
mov byte [rbp + 0x1a9], 7
mov eax, 0xffffffff
mov dword [rbp + 0x1ac], eax
mov rcx, qword [rbx + 0x2b8]
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rcx + 0x3b0]
call fcn.14008ac90
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x85a], 0
jmp case.0x140042bfa.2
mov byte [rbp + 0x1a9], recvfrom
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je 0x140043655
mov rcx, qword [0x14022a710]
call fcn.140039bb0
test eax, eax
je 0x140043655
test r14b, r14b
je 0x140043655
mov dword [rbp + 0x1ac], 0x1000000
jmp 0x140043660
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x14004380c
cmp ecx, 1
jne case.0x140042bfa.2
lea rdx, [rbp + 0x2f0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov r15d, eax
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
lea esi, [r15 - 3]
test esi, esi
je 0x14004379c
mov edi, 2
nop word [rax + rax]
lea ecx, [rdi - 2]
lea rdx, [rbp + 0x2f0]
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.14004a590
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 2
je 0x140043788
sub eax, 1
je 0x14004377c
sub eax, 1
je 0x140043770
cmp eax, 1
jne 0x140043792
mov eax, edi
mov byte [rbp + rax + 0x2f0], Ordinal_102
jmp 0x140043792
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSAStartup
jmp 0x140043792
mov eax, edi
mov byte [rbp + rax + 0x2f0], WSAStartup
jmp 0x140043792
mov eax, edi
mov byte [rbp + rax + 0x2f0], reloc.dwmapi.dll_Ordinal_102
add edi, 4
lea eax, [rdi - 2]
cmp eax, esi
jb 0x140043730
mov qword [rbp + 0x1f8], 0x30207
mov ecx, r15d
shl ecx, 0x10
mov eax, r15d
and eax, 0xff00
or ecx, eax
shl ecx, 8
mov eax, r15d
sar eax, 8
and eax, 0xff00
or ecx, eax
mov eax, r15d
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x200], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov r8d, r15d
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
jmp case.0x140042bfa.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x105
ja case.0x140042bfa.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x140042bfa.2
cmp edi, 0x106
jae 0x14004446c
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
xor sil, sil
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.My_Documents
lea rcx, [rbp + 0x2f0]
call fcn.14015bca4
mov r15, 0xffffffffffffffff
mov edi, r15d
test eax, eax
mov eax, 5
cmove edi, eax
lea r8d, [r15 + 8]
lea rdx, str.Desktop
lea rcx, [rbp + 0x2f0]
call fcn.14015bca4
test eax, eax
cmove edi, r13d
lea r8d, [r15 + 0x12]
lea rdx, str.Network_Favorites
lea rcx, [rbp + 0x2f0]
call fcn.14015bca4
test eax, eax
jne 0x1400438fe
lea edi, [rax + 0x13]
jmp 0x140043903
cmp edi, r15d
je 0x140043965
lea r8, [rbp + 0xa70]
mov edx, edi
mov rcx, qword [rbx + 0x2b8]
call fcn.140048a80
test al, al
je 0x140043962
lea rcx, [rbp + 0xa70]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], sil
jne 0x140043926
cmp byte [rbp + rax + 0xa6f], 0x5c
je 0x14004394d
lea rdx, [0x1401ef4f8]
lea rcx, [rbp + 0xa70]
call fcn.14004a5a0
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x2f0]
call fcn.14004a5b0
jmp 0x140043965
mov sil, 1
lea rdx, [0x1401f4de4]
lea rcx, [rbp + 0x2f0]
call fcn.14004a5a0
mov qword [rbp + 0x15c], r13
mov dword [rbp + 0x158], 0x10207
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp r14, r15
je 0x140043b47
test sil, sil
jne 0x140043b47
lea rax, [rbp + 0x2f0]
mov rdx, r15
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400439d0
dec rdx
mov rax, rdx
shr rax, 0x18
movzx ecx, al
mov rax, rdx
shl rax, 8
and eax, 0xff0000
or ecx, eax
mov rax, rdx
shr rax, 8
and eax, 0xff00
or ecx, eax
shl rdx, 0x18
or ecx, edx
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
lea rcx, [rbp + 0x2f0]
mov rax, r15
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x140043a34
lea r8d, [rax - 1]
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008af60
nop word [rax + rax]
movzx ecx, byte [rbp + 0x56d]
movzx eax, byte [rbp + 0x56c]
test byte [rbp + 0x540], 0x10
je 0x140043a7f
cmp al, 0x2e
jne 0x140043a9c
test cl, cl
jne 0x140043a9c
cmp al, 0x2e
jne 0x140043a9c
cmp cl, al
jne 0x140043a90
cmp byte [rbp + 0x56e], 0
je 0x140043a9c
cmp al, 0x2e
jne 0x140043a9c
test cl, cl
je 0x140043b1e
lea rcx, [rbp + 0x56c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [rax + 0x2e]
movsxd r8, edi
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x750]
call fcn.140149f10
mov eax, edi
mov ecx, edi
and eax, 0xff00
shl ecx, 0x10
or ecx, eax
mov eax, edi
sar eax, 8
and eax, 0xff00
shl ecx, 8
or ecx, eax
mov eax, edi
shr eax, 0x18
or ecx, eax
mov dword [rbp + 0x160], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov r8d, edi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008af60
lea rdx, [rbp + 0x540]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140043a60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov word [rbp + 0x15a], r13w
mov dword [rbp + 0x160], r13d
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x158]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ac90
jmp case.0x140042bfa.2
movzx ecx, word [rbp + 0x142]
sub ecx, 1
je 0x140043eb9
sub ecx, 3
je 0x140043d22
cmp ecx, 1
jne case.0x140042bfa.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x208
ja case.0x140042bfa.2
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x140042bfa.2
cmp esi, 0x209
jae 0x140044472
mov byte [rbp + rsi + 0x750], 0
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
mov edx, 0x2a
lea rcx, [rbp + 0x750]
call fcn.1400380d0
mov rdi, rax
test rax, rax
je case.0x140042bfa.2
lea rdx, [rax + 1]
lea rcx, [rbp + 0x540]
call fcn.14004a5c0
mov byte [rdi], 0
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0xa70]
call fcn.14004a5c0
mov byte [rdi], 0x2a
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
mov dword [rbp + 0x208], 0x80b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x20c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x210], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x208]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov r8d, esi
lea rdx, [rbp + 0x750]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
test edi, edi
je case.0x140042bfa.2
lea rax, [rbp + 0x188]
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x188]
call fcn.140021ce0
mov rdi, rax
lea rdx, [rbp + 0xa70]
lea rcx, [rbp + 0x1b8]
call fcn.140021ce0
nop
mov r8, rdi
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.14003a0e0
jmp case.0x140042bfa.2
mov ecx, dword [rbp + 0x148]
mov edi, ecx
and edi, 0xff0000
mov eax, ecx
shr eax, 0x10
or edi, eax
shr edi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or edi, eax
cmp edi, 0x104
ja case.0x140042bfa.2
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x140042bfa.2
cmp edi, 0x105
jae 0x140044478
mov byte [rbp + rdi + 0x2f0], 0
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
lea rcx, [rbp + 0x2f0]
call fcn.140039fe0
movzx r14d, al
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x188]
call fcn.140021ce0
nop
test r14b, r14b
je 0x140043dfe
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140039ec0
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.14004a250
lea rcx, [rbp + 0x1b8]
call fcn.140016f30
lea rcx, [rbp + 0x188]
call fcn.14004a240
mov rsi, rax
lea rcx, [rbp + 0x2f0]
call fcn.140039df0
movzx edi, al
mov dword [rbp + 0x218], 0x70b07
mov ecx, 0xffffffff
test al, al
cmovne ecx, r13d
mov dword [rbp + 0x21c], ecx
lea eax, [rsi + 1]
bswap eax
mov dword [rbp + 0x220], eax
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x218]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
lea rcx, [rbp + 0x188]
call fcn.140021cd0
mov rdx, rax
lea r8d, [rsi + 1]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
test edi, edi
je 0x140043ea8
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021ce0
movzx r8d, r14b
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.14003a080
nop
lea rcx, [rbp + 0x188]
call fcn.140016f30
jmp case.0x140042bfa.2
mov ecx, dword [rbp + 0x148]
mov esi, ecx
and esi, 0xff0000
mov eax, ecx
shr eax, 0x10
or esi, eax
shr esi, 8
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shl eax, 8
or esi, eax
cmp esi, 0x104
ja case.0x140042bfa.2
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x140042bfa.2
cmp esi, 0x105
jae 0x140044466
mov byte [rbp + rsi + 0x2f0], 0
mov rcx, qword [0x14022a710]
call fcn.140039b80
test eax, eax
je case.0x140042bfa.2
test r14b, r14b
je case.0x140042bfa.2
xor edx, edx
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov dword [rbp + 0x228], 0x40b07
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, r13d
mov dword [rbp + 0x22c], ecx
mov ecx, dword [rbp + 0x148]
mov dword [rbp + 0x230], ecx
mov r9b, 7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [rbp + 0x228]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008adc0
mov r8d, esi
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbx + 0x2a8]
call fcn.14008ae40
test edi, edi
je case.0x140042bfa.2
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x1b8]
call fcn.140021ce0
mov rdx, rax
mov rcx, qword [rbx + 0x2b8]
call fcn.14003a020
jmp case.0x140042bfa.2
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x14004402a
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7f0
call fcn.14008b4a0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 0
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x82a], 0
je case.0x140042bfa.2
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.14008b4a0
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 0
mov rax, qword [rbx + 0x2b8]
mov dword [rax + 0x67c], r13d
lea rcx, [rbp + 0x90]
call fcn.140019dc0
jmp 0x14004198e
mov r8d, 4
sub r8d, edi
mov eax, edi
lea rdx, [rbp + 0x140]
add rdx, rax
mov rcx, qword [rbx + 0x2a8]
call fcn.14008b150
test eax, eax
je case.0x1400400a2.1
mov rcx, qword [rbx + 0x2a8]
call fcn.1400380c0
jmp 0x14004198e
lea r8, str.vncClientThread::run_:_GIIExtension_not_supported_in_readonly_mode_n
xor edx, edx
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
lea rcx, [rbp - 0x20]
call fcn.140019dc0
jmp 0x140044436
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x118], 0
cmp byte [0x14021fa63], 0
je 0x14004411b
mov byte [rbx + 0x98], 1
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x80d], 0
je 0x14004416e
mov byte [rax + 0x80c], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x80d], 0
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x7f0
call fcn.14008b4a0
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x82a], 0
je 0x1400441b3
mov byte [rax + 0x829], 1
mov rcx, qword [rbx + 0x2b8]
mov rcx, qword [rcx + 0x810]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x82a], 0
mov rcx, qword [rbx + 0x2b8]
add rcx, 0x810
call fcn.14008b4a0
mov rcx, qword [rbp + 0x38]
call fcn.140021350
mov rcx, qword [rbx + 0x2b8]
cmp byte [rcx + 0x9c9], 0
je 0x1400441ef
mov rcx, qword [rcx + 0x4b0]
xor edx, edx
mov rcx, qword [rcx + 0x90]
call fcn.140051240
mov rax, qword [rbx + 0x2b8]
mov byte [rax + 0x9c9], 0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140044217
call qword [sym.imp.USER32.dll_CloseDesktop]
test eax, eax
jne 0x140044217
lea r8, str.vncClientThread::run_:_failed_to_close_desktop_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rax, qword [rbx + 0x2b8]
mov r9, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [r9 + 0xa0]
movsx edi, ax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x98]
mov r9, rax
mov dword [rsp + 0x20], edi
lea r8, str.vncClientThread::run_:_client_disconnected_:__s___hd__n
mov edx, 1
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r8d, 0x104
lea rdx, [rbp + 0x960]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14004429c
mov edx, 0x5c
lea rcx, [rbp + 0x960]
call fcn.1400380d0
mov byte [rax], 0
lea rdx, str.logging.dll
lea rcx, [rbp + 0x960]
call fcn.140019510
lea rcx, [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x140044337
lea rdx, str.LOGEXIT
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rdx, qword [rbx + 0x2b8]
cmp byte [rdx + 0x3c9], 0
je 0x1400442e6
cmp byte [rdx + 0x3ca], 0
je 0x1400442e6
mov r12b, 1
jmp 0x1400442e9
xor r12d, r12d
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax]
mov rsi, rax
mov rcx, rax
call qword [rdx + 0xa0]
movsx r14d, ax
mov rcx, rsi
call qword [rdi + 0x90]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x98]
mov rcx, rax
movzx r9d, r12b
mov r8d, r14d
mov rdx, rdi
call r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rcx + 0x590]
test rax, rax
je 0x14004436e
mov rcx, rax
call fcn.14003a260
mov rcx, qword [rbx + 0x2b8]
xor edx, edx
mov rcx, qword [rcx + 0x590]
call fcn.1400b2390
mov rcx, qword [rbx + 0x2b8]
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0xa0]
movzx edx, ax
mov rcx, qword [rbx + 0x2b0]
call qword [rdi + 0xb8]
cmp byte [0x14021fa63], 0
jne 0x140044436
mov rax, qword [rbx + 0x2b8]
cmp byte [rax + 0x3af], 0
je 0x140044436
lea r8, str.vncClientThread::run_:_PostAddNewClient_II_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rbx + 0x2b8]
mov r8, qword [rcx]
movzx edx, byte [rax + 0x3af]
call qword [r8 + 0x258]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
mov edx, dword [rbx + 0x9c]
call qword [rax + 0x278]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0xa0]
call qword [rax + 0x288]
mov rcx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
lea rdx, [rbx + 0x19f]
call qword [rax + 0x298]
mov edx, 0x457
mov ecx, edx
call fcn.140021520
mov rcx, qword [rbp + 0xc80]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0xd90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140147c98
nop
call fcn.140147c98
int3
call fcn.140147c98
int3
call fcn.140147c98
int3