Function at 0x4858b0
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Delete registry value
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xdc8
mov eax, dword [0x5b0008]
xor eax, esp
mov dword [esp + 0xdc4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [0x5bb8f8]
mov dword [esp + 0x10], esi
push edi
test eax, eax
jne 0x4858f9
push 0x20
call fcn.0051946c
add esp, 4
mov ecx, eax
call fcn.00479de0
mov dword [0x5bb8f8], eax
mov ecx, eax
cmp byte [ecx + 9], 1
jne 0x48591a
push 0x10
push str.Warning
mov edx, str.WIndows_XP_require_special_build
call fcn.00425040
mov eax, dword [0x5bb8f8]
add esp, 8
test eax, eax
jne 0x485934
push 0x20
call fcn.0051946c
add esp, 4
mov ecx, eax
call fcn.00479de0
mov dword [0x5bb8f8], eax
cmp byte [eax + 0xd], 1
jne 0x485969
push 0x10
push str.Unsupported_OS
mov edx, str.Error_OS_not_supported
call fcn.00425040
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SHCore.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetProcessDpiAwareness
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4859a8
push 2
call eax
jmp 0x4859ba
push str.SetProcessDPIAware
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4859ba
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x4859cd
push edi
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4859d8
push eax
call ecx
mov eax, dword [0x5be08c]
push 0
push 2
mov byte [esp + 0x2b], 0
mov word [eax + 0xe2c], 0
call fcn.0052d12a
add esp, 4
push eax
call fcn.0052e69b
add esp, 8
mov dword [0x5bb944], 0
lea eax, [esp + 0x798]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x485a38
lea eax, [esp + 0x798]
push 0x5c
push eax
call fcn.0051a9e0
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x798]
push eax
lea eax, [esp + 0x694]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea eax, [esp + 0x690]
push 0x597578
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
lea eax, [esp + 0x690]
push str.vnclang_server.dll
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [esp + 0x2c]
test eax, eax
cmove eax, edi
mov dword [0x5bb944], eax
call fcn.00485200
push 0x104
lea eax, [esp + 0x8a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x485adc
lea eax, [esp + 0x8a0]
push 0x5c
push eax
call fcn.0051a9e0
add esp, 8
test eax, eax
je 0x485b3b
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x8a4]
push eax
lea eax, [esp + 0xab8]
push 0x104
push eax
call fcn.0052c878
add esp, 0x10
mov byte [esp + 0xbb3], 0
call fcn.00474850
mov dword [0x5bbad0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x28]
call fcn.004832e0
cmp dword [esp + 0x28], 0
jne 0x485b53
push 0
push 0x59d508
mov edx, 0x5bcdf8
call fcn.00425040
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
xor edi, edi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x485b60
sub ecx, edx
je 0x485b93
nop dword [eax + eax]
movsx eax, byte [esi + edi]
push eax
call fcn.0052c623
mov ecx, esi
mov byte [esi + edi], al
add esp, 4
inc edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x485b86
sub ecx, edx
cmp edi, ecx
jb 0x485b70
mov ecx, esi
xor eax, eax
mov dword [esp + 0x28], eax
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x485ba0
sub ecx, edx
je 0x487295
nop
add esi, edi
cmp byte [esi], 0x20
jle 0x486682
push 8
push str._inifile
push esi
mov dword [esp + 0x34], 1
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x485ca0
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x9a8]
push 0x104
push eax
push 0x104
lea eax, [esp + 0xbc4]
add edi, 8
push eax
push 0x104
lea eax, [esp + 0xcd4]
push eax
push 0x104
lea eax, [esp + 0x5a4]
push eax
lea eax, [esi + 1]
add eax, edi
push eax
call fcn.0052ed1d
add esp, 0x24
lea eax, [esp + 0x9a8]
push 0x20
push eax
call fcn.0051ad90
add esp, 8
test eax, eax
je 0x485c3d
mov byte [eax], 0
lea eax, [esp + 0x9a8]
push eax
lea eax, [esp + 0xbbc]
push eax
lea eax, [esp + 0xcc8]
push eax
lea eax, [esp + 0x594]
push eax
lea eax, [esp + 0x490]
push 0x104
push eax
call fcn.0052e81d
lea eax, [esp + 0x498]
push eax
call fcn.0052cbc2
lea ecx, [esp + 0x49c]
mov dword [0x5b2cdc], eax
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x485c90
sub ecx, edx
add edi, ecx
jmp 0x486686
push 0xf
push str._settingshelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487247
push 0x12
push str._stopservicehelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487219
push 5
push str._kill
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487192
push 0xd
push str._openhomepage
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x48715c
push 0xa
push str._openforum
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x48714f
push 0x13
push str._startservicehelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487121
push 0xe
push str._installhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4870f3
push 0x10
push str._uninstallhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4870c5
push 0x12
push str._softwarecadhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487097
push 0x15
push str._delsoftwarecadhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486fda
push 0x15
push str._rebootsafemodehelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486fac
push 0x12
push str._rebootforcehelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486f7e
push 0x15
push str._securityeditorhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486f50
push 0xf
push str._securityeditor
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486ea5
push 9
push str._settings
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486e5c
push 0x10
push str._dsmpluginhelper
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486d78
push 0x12
push str._dsmplugininstance
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486d2f
push 0xc
push 0x56bd90
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486c92
push 0xf
push 0x56bd2c
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486c01
push 0xf
push 0x56bcac
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486af7
push 0xc
push 0x56bdc4
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486a26
push 0xc
push str._stopservice
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4869d9
push 0xd
push str._startservice
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4869a8
push 0xe
push str._installdriver
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4869b4
push 8
push str._install
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4868f6
push 0xa
push str._uninstall
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486802
push 0xb
push str._preconnect
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x485f33
add edi, 0xb
mov byte [0x5b31a6], 1
jmp 0x486682
push 0xc
push str._service_run
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4867dd
push 0x10
push str._service_rdp_run
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x4867ae
push 8
push str._service
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x486787
push 4
push str._run
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
je 0x487295
push 8
push str._sc_exit
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x485fbb
mov eax, dword [0x5be08c]
add edi, 8
mov byte [eax + 0xe2c], 1
jmp 0x486682
push 0xa
push str._sc_prompt
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x485fe3
mov eax, dword [0x5be08c]
add edi, 0xa
mov byte [eax + 0xe2d], 1
jmp 0x486682
push 6
push str._multi
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x486006
mov byte [0x5b2c32], 1
add edi, 6
jmp 0x486682
push 0xe
push str._stopreconnect
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x486027
add edi, 0xe
call fcn.00425590
jmp 0x486682
push 0xe
push str._autoreconnect
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x486153
mov esi, dword [esp + 0x14]
add edi, 0xe
mov dword [esp + 0xc], eax
mov eax, edi
mov byte [esp + 0x23], 1
mov dword [esp + 0x10], edi
mov cl, byte [esi + edi]
cmp cl, 0x20
jg 0x486072
nop dword [eax]
test cl, cl
je 0x48606e
mov cl, byte [esi + eax + 1]
inc eax
cmp cl, 0x20
jle 0x486060
mov dword [esp + 0x10], eax
push 3
add eax, esi
push 0x56baec
push eax
mov dword [esp + 0x14], eax
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x4860ef
mov eax, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0x18], eax
cmp byte [esi + eax], 0x20
jle 0x4860ab
nop dword [eax]
inc edi
cmp byte [esi + edi], 0x20
jg 0x4860a0
mov dword [esp + 0x18], edi
mov ecx, edi
sub ecx, eax
mov dword [esp + 0x10], ecx
je 0x4860ef
lea esi, [ecx + 1]
push esi
call fcn.005194aa
add esp, 4
mov edi, eax
push dword [esp + 0x10]
push dword [esp + 0xc]
push esi
push edi
call fcn.0052c878
mov eax, dword [esp + 0x20]
push edi
mov byte [edi + eax], 0
call fcn.0052cfcf
mov edi, dword [esp + 0x2c]
add esp, 0x14
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
call fcn.00425440
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x48613d
mov byte [0x5bb6f1], 1
test eax, eax
jne 0x48611c
mov byte [0x5bb941], 1
mov byte [0x5bb6f1], al
jmp 0x486686
push eax
push 0x14
push 0x5bbda4
call fcn.0051f3ce
add esp, 0xc
push dword [esp + 0xc]
call fcn.00519467
add esp, 4
jmp 0x486686
test eax, eax
je 0x486686
push eax
call fcn.00519467
add esp, 4
jmp 0x486686
push 4
push str._id:
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x486214
mov esi, dword [esp + 0x14]
inc edi
xor ecx, ecx
mov dword [esp + 0x18], edi
cmp byte [esi + edi], 0x20
mov eax, edi
mov dword [esp + 0xc], ecx
lea edx, [esi + edi]
mov dword [esp + 8], edx
jle 0x48619b
nop dword [eax]
inc eax
cmp byte [esi + eax], 0x20
jg 0x486190
mov dword [esp + 0x18], eax
mov edx, eax
sub edx, edi
mov dword [esp + 0x10], edx
je 0x4861e1
lea esi, [edx + 1]
push esi
call fcn.005194aa
add esp, 4
mov edi, eax
push dword [esp + 0x10]
push dword [esp + 0xc]
push esi
push edi
call fcn.0052c878
mov eax, dword [esp + 0x20]
push edi
mov byte [eax + edi], 0
call fcn.0052cfcf
mov esi, dword [esp + 0x28]
mov ecx, eax
mov dword [esp + 0x20], eax
add esp, 0x14
mov eax, dword [esp + 0x18]
mov edi, eax
call fcn.00425730
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x48613d
mov byte [0x5bb989], 1
test eax, eax
jne 0x48611c
mov byte [0x5bb942], 1
mov byte [0x5bb989], al
jmp 0x486686
push 8
push str._connect
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x48659b
cmp byte [esp + 0x23], al
jne 0x486237
call fcn.00425530
mov esi, dword [esp + 0x14]
add edi, 8
mov eax, edi
mov dword [esp + 0x24], edi
mov cl, byte [esi + edi]
cmp cl, 0x20
jg 0x486262
nop dword [eax]
test cl, cl
je 0x48625e
mov cl, byte [esi + eax + 1]
inc eax
cmp cl, 0x20
jle 0x486250
mov dword [esp + 0x24], eax
cmp byte [esi + eax], 0x20
lea edx, [esi + eax]
mov ecx, eax
mov dword [esp + 8], eax
mov dword [esp + 0x1c], edx
jle 0x486280
inc ecx
cmp byte [esi + ecx], 0x20
jg 0x486275
mov dword [esp + 8], ecx
sub ecx, eax
mov dword [esp + 0x30], ecx
je 0x48653e
lea eax, [ecx + 1]
push eax
mov dword [esp + 0x10], eax
call fcn.005194aa
add esp, 4
mov edi, eax
mov dword [esp + 0x18], edi
push dword [esp + 0xc]
call fcn.005194aa
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x30]
push dword [esp + 0x20]
push dword [esp + 0x14]
push edi
call fcn.0052c878
push dword [esp + 0x28]
mov ecx, edi
mov edi, dword [esp + 0x1c]
sub ecx, dword [esp + 0x38]
push dword [esp + 0x20]
push dword [esp + 0x28]
mov byte [ecx + edi], 0
call fcn.0051f3ce
add esp, 0x1c
push 0x5b
push dword [esp + 0x1c]
call fcn.0051ad90
push 0x5d
push dword [esp + 0x24]
mov dword [esp + 0x18], eax
call fcn.0051ad90
add esp, 0x10
mov edx, eax
cmp dword [esp + 8], 0
mov dword [esp + 0x30], edx
je 0x48635c
test edx, edx
je 0x48635c
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x1c], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x486320
sub ecx, dword [esp + 0x1c]
lea eax, [edx + 1]
push ecx
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.0052c878
mov eax, dword [esp + 0x40]
mov byte [eax], 0
mov eax, dword [esp + 0x18]
inc eax
push eax
push dword [esp + 0x20]
push dword [esp + 0x30]
call fcn.0051f3ce
add esp, 0x1c
jmp 0x486371
push 0x3a
push dword [esp + 0x1c]
call fcn.0051ad90
add esp, 8
test eax, eax
je 0x486371
mov byte [eax], 0
push 0x3a
push dword [esp + 0x14]
mov dword [esp + 0x14], 0x157c
call fcn.0051ad90
add esp, 8
test eax, eax
je 0x4863a2
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x486395
inc eax
push eax
call fcn.00527749
mov dword [esp + 0x10], eax
add esp, 4
push dword [esp + 0x10]
call fcn.00519467
add esp, 4
push dword [esp + 0xc]
push dword [esp + 0x1c]
push str.WinMain_:_test...__s__d_n
push 0
push 0x5b0d48
call fcn.0041cc90
add esp, 0x14
push dword [esp + 0x18]
push 0xff
push 0x5bbb98
call fcn.0051f3ce
mov eax, dword [0x5be08c]
add esp, 0xc
cmp dword [eax + 0xe64], 0
je 0x4864a1
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x70]
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
call fcn.00484300
test al, al
je 0x486712
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5b0d48
call fcn.0041cc90
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp byte [0x5b2c32], 0
movups xmm0, xmmword [esp + 0x70]
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [0x5be074]
movups xmmword [0x5b2ca0], xmm0
mov dword [esp + 0x24], eax
jne 0x48650e
mov eax, dword [0x5be08c]
cmp byte [eax + 0xe2c], 0
jne 0x48650e
cmp byte [eax + 0xe2d], 0
jne 0x48650e
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x48648d
mov eax, dword [0x5b2c94]
test eax, eax
je 0x48651d
lea ecx, [esp + 0x70]
push ecx
push dword [esp + 0xc]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x5bbda0], 0
jne 0x4864fd
mov ecx, dword [esp + 0x18]
call fcn.004842d0
mov dword [esp + 8], eax
test eax, eax
je 0x486762
push str.WinMain_:_PostAddNewClient_III__n
push 0
push 0x5b0d48
call fcn.0041cc90
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [esp + 8]
call fcn.004256c0
test eax, eax
jne 0x4864fd
mov eax, dword [esp + 0xc]
mov dword [0x5bbda0], eax
mov eax, dword [esp + 8]
mov byte [0x5bb6f2], 1
mov dword [0x5bc564], eax
push dword [esp + 0x18]
call fcn.00519467
add esp, 4
jmp 0x486686
mov cl, 1
call fcn.00425820
test eax, eax
jne 0x48648d
movups xmm0, xmmword [esp + 0x70]
mov eax, dword [esp + 0xc]
mov byte [0x5bb6f2], 1
mov dword [0x5bbda0], eax
movups xmmword [0x5bbe38], xmm0
jmp 0x4864a1
push str.WinMain_:_PostAddNewClient_IIII_n
push 0
push 0x5b0d48
call fcn.0041cc90
add esp, 0xc
xor edx, edx
xor ecx, ecx
call fcn.00425650
test eax, eax
jne 0x486686
mov dword [0x5bbda0], eax
mov eax, dword [0x5be08c]
mov byte [0x5bb6f2], 1
cmp dword [eax + 0xe64], 0
je 0x48658c
xorps xmm0, xmm0
movups xmmword [0x5bbe38], xmm0
jmp 0x486686
mov dword [0x5bc564], 0
jmp 0x486686
push 9
push str._repeater
push esi
call fcn.005274a0
add esp, 0xc
test eax, eax
jne 0x48676e
mov esi, dword [esp + 0x14]
add edi, 9
mov eax, edi
mov cl, byte [esi + edi]
cmp cl, 0x20
jg 0x4865d2
test cl, cl
je 0x4865d2
mov cl, byte [esi + eax + 1]
inc eax
cmp cl, 0x20
jle 0x4865c4
cmp byte [esi + eax], 0x20
lea edx, [esi + eax]
mov ecx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], edx
jle 0x4865f0
inc ecx
cmp byte [esi + ecx], 0x20
jg 0x4865e5
mov dword [esp + 0x24], ecx
sub ecx, eax
mov dword [esp + 8], ecx
je 0x486686
mov eax, dword [0x5bbad4]
test eax, eax
je 0x48661c
push eax
call fcn.00519467
mov ecx, dword [esp + 0xc]
add esp, 4
mov dword [0x5bbad4], 0
lea esi, [ecx + 1]
push esi
call fcn.005194aa
mov edi, dword [esp + 0xc]
add esp, 4
mov dword [0x5bbad4], eax
push edi
push dword [esp + 0x20]
push esi
push eax
call fcn.0052c878
mov eax, dword [0x5bbad4]
push str.WinMain_:_PostAddNewRepeaterClient_I_n
push 0
push 0x5b0d48
mov byte [eax + edi], 0
call fcn.0041cc90
add esp, 0x1c
call fcn.004254c0
test eax, eax
jne 0x48667e
xorps xmm0, xmm0
mov byte [0x5bb6f3], 1
mov dword [0x5bbda0], eax
mov dword [0x5bc564], eax
movups xmmword [0x5bbe38], xmm0
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, esi
inc edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x486690
sub ecx, edx
cmp edi, ecx
jb 0x485bb0
cmp dword [esp + 0x28], 0
je 0x487295
mov ecx, dword [0x5bb8f8]
test ecx, ecx
je 0x4866bc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [0x5b2e38]
test eax, eax
jne 0x4866e6
push 0x1134
call fcn.0051946c
add esp, 4
mov ecx, eax
call fcn.0042a950
mov dword [0x5b2e38], eax
test eax, eax
je 0x487277
push 0x1134
push eax
call fcn.0051949c
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
xorps xmm0, xmm0
movups xmmword [0x5bbe38], xmm0
push 0x7d0
mov dword [0x5bbda0], 0
mov byte [0x5bb6f2], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x18]
call fcn.00519467
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov dword [0x5bc564], 0
jmp 0x48671c
push 0x40
push 0x5bc788
mov edx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
call fcn.00425040
add esp, 8
jmp 0x4866ac
mov ecx, dword [esp + 0x14]
call fcn.0042cc30
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x2c]
call fcn.00485580
test al, al
je 0x487277
mov eax, dword [0x5be08c]
mov dword [eax + 0xe20], 1
mov dword [eax + 0xe24], 1
jmp 0x4872a2
mov ecx, dword [esp + 0x2c]
call fcn.00485580
test al, al
je 0x487277
mov eax, dword [0x5be08c]
mov dword [eax + 0xe20], 1
jmp 0x4872a2
mov esi, dword [esp + 0x14]
add esi, edi
mov al, byte [esi]
test al, al
je 0x4868a4
movzx eax, al
push eax
call fcn.0052e9e0
add esp, 4
test eax, eax
jne 0x48682c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x486812
jmp 0x4868a4
mov al, byte [esi]
test al, al
je 0x4868a4
movzx eax, al
push eax
call fcn.0052e9e0
add esp, 4
test eax, eax
je 0x48684c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x486832
jmp 0x4868a4
mov al, byte [esi]
test al, al
je 0x4868a4
cmp al, 0x22
jne 0x48685c
inc esi
cmp byte [esi], 0
je 0x4868a4
push 0x22
push esi
call fcn.0051a9e0
add esp, 8
test eax, eax
je 0x48686e
mov byte [eax], 0
cmp byte [esi], 0
je 0x4868a4
push str.uvnc_service
push esi
call fcn.0052c8bc
add esp, 8
test eax, eax
je 0x4868a4
push 0x100
push esi
push 0x100
push str.uvnc_service
call fcn.0052c878
add esp, 0x10
mov byte [0x5b0ba7], 0
push str.uvnc_service
push str.net_stop___s_
lea eax, [esp + 0x88]
push 0x124
push eax
call fcn.00425e80
add esp, 0x10
lea eax, [esp + 0x80]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.0042cf50
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [esp + 0x14]
add esi, edi
mov al, byte [esi]
test al, al
je 0x486998
movzx eax, al
push eax
call fcn.0052e9e0
add esp, 4
test eax, eax
jne 0x486920
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x486906
jmp 0x486998
mov al, byte [esi]
test al, al
je 0x486998
movzx eax, al
push eax
call fcn.0052e9e0
add esp, 4
test eax, eax
je 0x486940
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x486926
jmp 0x486998
mov al, byte [esi]
test al, al
je 0x486998
cmp al, 0x22
jne 0x486950
inc esi
cmp byte [esi], 0
je 0x486998
push 0x22
push esi
call fcn.0051a9e0
add esp, 8
test eax, eax
je 0x486962
mov byte [eax], 0
cmp byte [esi], 0
je 0x486998
push str.uvnc_service
push esi
call fcn.0052c8bc
add esp, 8
test eax, eax
je 0x486998
push 0x100
push esi
push 0x100
push str.uvnc_service
call fcn.0052c878
add esp, 0x10
mov byte [0x5b0ba7], 0
call fcn.0042cc80
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
jmp 0x4869e3
mov cl, 1
call fcn.00434d80
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push str.uvnc_service
push str.net_stop___s_
lea eax, [esp + 0x88]
push 0x124
push eax
call fcn.00425e80
add esp, 0x10
lea eax, [esp + 0x80]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x487277
lea eax, [esp + 0x74]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 1
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x94], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x487277
lea eax, [esp + 0x80]
mov dword [esp + 0x80], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x84], 6
push 0
jae 0x486ad1
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push str.uvnc_service
push 0x59b2b8
push str.SYSTEMCurrentControlSetControlSafeBoot_s_s
lea eax, [esp + 0x8c]
mov dword [esp + 0x28], 0
push 0x400
push eax
call fcn.0042f270
add esp, 0x14
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x9c]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487277
push 8
push str.Service
push 1
push eax
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042d100
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x487277
lea eax, [esp + 0x74]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 1
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x94], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x487277
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487277
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.System
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x486ce0
push str.SoftwareSASGeneration
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x10]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487277
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.System
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x486d08
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x486c62
mov eax, dword [esp + 0x14]
add eax, 0x13
add eax, edi
push eax
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea ecx, [esp + 0x80]
call fcn.0047cde0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
add eax, 0x11
add eax, edi
push eax
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea eax, [esp + 0x480]
push str.__dsmplugininstance
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x484]
push 0x104
push eax
call fcn.0051f428
add esp, 0xc
lea eax, [esp + 0x588]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x38], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x588]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x480]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x44], str.runas
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
add eax, 0xa
add eax, edi
push eax
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea ecx, [esp + 0x80]
call fcn.004233f0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0x104
lea eax, [esp + 0x84]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x486eea
lea eax, [esp + 0x80]
push 0x5c
push eax
call fcn.0051a9e0
push str._authSSP.dll
push 0x104
mov byte [eax], 0
lea eax, [esp + 0x90]
push eax
call fcn.0051f428
add esp, 0x14
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x487174
push str.vncEditSecurity
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x5bbad0]
push 0
call esi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00424f80
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042d490
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042d530
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x80]
mov dword [esp + 0x80], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x84], 6
jb 0x487277
push 0x104
lea eax, [esp + 0x58c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x38], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x588]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x44], str.runas
mov dword [esp + 0x4c], str._delsoftwarecad
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041ccc0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00424ec0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00424e00
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00424d40
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0
push 0
push str.https:__forum.uvnc.com
jmp 0x487167
push 1
push 0
push 0
push str.https:__www.uvnc.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x5f9660], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x5f9660]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
jne 0x4871dd
mov esi, dword [0x5b2c94]
test esi, esi
je 0x487277
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push esi
call edi
push 0
push 0
push 0x10
push esi
call edi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00424c80
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.0051f3ce
add esp, 0xc
lea ecx, [esp + 0x80]
call fcn.004232e0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xdc4]
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x2c]
call fcn.00485580
test al, al
je 0x487277
call fcn.004877f0
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0xdcc]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00519459
mov esp, ebp
pop ebp
ret 0x10