Function at 0x471cb0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f60e0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.d:_saasultravncwinvncwinvnc_vncmenu.cpp_:_vncmenu_killed_n
push 0
push 0x558c50
call fcn.0041c840
mov eax, dword [edi + 0x1118]
add esp, 0xc
test eax, eax
je 0x471d21
push eax
call fcn.004dab64
add esp, 4
mov dword [edi + 0x1118], 0
mov eax, dword [edi + 0x111c]
test eax, eax
je 0x471d3e
push eax
call fcn.004dab64
add esp, 4
mov dword [edi + 0x111c], 0
mov eax, dword [edi + 0x122c]
test eax, eax
je 0x471d76
push str.WTSUnRegisterSessionNotification
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x471d60
push dword [edi + 0xefc]
call eax
push dword [edi + 0x122c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 0x122c], 0
mov eax, dword [edi + 0x1224]
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
je 0x471d89
push eax
call esi
mov eax, dword [edi + 0x1228]
test eax, eax
je 0x471d96
push eax
call esi
push 0
push 2
mov ecx, edi
call fcn.00472630
mov eax, dword [edi + 0xf00]
test eax, eax
je 0x471db2
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov esi, dword [edi]
test esi, esi
je 0x471e31
mov eax, dword [esi]
mov ecx, dword [edi + 0xefc]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax + 0x6c]
cmp eax, vtable.vncServer.0
jne 0x4721b0
lea eax, [esi + 0x38]
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x358]
mov eax, dword [ecx]
cmp eax, ecx
je 0x471dfb
mov edx, dword [ebp - 0x2c]
nop dword [eax]
cmp dword [eax + 8], edx
je 0x471e07
mov eax, dword [eax]
cmp eax, ecx
jne 0x471df0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x471e31
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push 0xc
push eax
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [esi + 0x35c]
call fcn.004cbf6d
add esp, 8
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x200]
cmp eax, vtable.vncServer.0
jne 0x4721ba
mov eax, dword [ecx + 0xdc]
test eax, eax
je 0x471f74
push dword [0x56a0b0]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restorewallpaper__i_n
push 8
push 0x558c50
call fcn.0041c840
mov eax, dword [0x56a0b0]
add esp, 0x10
test eax, eax
je 0x471f6a
push dword [0x56a0b4]
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restorewallpaper__i__i_n
push 8
push 0x558c50
call fcn.0041c840
add esp, 0x14
cmp dword [0x56a0b4], 0
je 0x471f06
push str.shell32.dll
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x471f06
push str.DllGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x471eee
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0x14
lea ecx, [ebp - 0x28]
movlpd qword [ebp - 0x24], xmm0
push ecx
movlpd qword [ebp - 0x1c], xmm0
call eax
test eax, eax
js 0x471eee
movzx esi, word [ebp - 0x24]
movzx eax, word [ebp - 0x20]
shl esi, 0x10
or esi, eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0x40047
jb 0x471f06
mov cl, 1
call fcn.00426010
push 2
push 0x569cb0
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x2c]
push eax
push 0x20006
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x471f6a
mov ecx, 0x56a0b8
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471f40
sub ecx, edx
push ecx
push 0x56a0b8
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x56a0b0], 0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
cmp eax, vtable.vncServer.0
jne 0x4721c1
mov eax, dword [ecx + 0xe0]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x47203d
cmp byte [0x569c17], 0
je 0x472036
xor esi, esi
nop dword [eax]
mov eax, dword [esi + 0x55abb0]
cmp eax, dword [esi + 0x55ab80]
je 0x47200f
push 2
push eax
mov eax, dword [esi + 0x518c40]
push 0
inc eax
push eax
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x471fed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 0x518c40]
inc eax
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_restore_SPI_value_for_0x_04x__0x_08x__n
push 8
jmp 0x472002
push dword [esi + 0x55abb0]
mov eax, dword [esi + 0x518c40]
inc eax
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restored_SPI_value_for_0x_04x_to_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x14
add esi, 4
cmp esi, 0x28
jb 0x471fb0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
movaps xmmword [0x55abb0], xmm0
movaps xmmword [0x55abc0], xmm0
movq qword [0x55abd0], xmm0
mov byte [0x569c17], 0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x210]
cmp eax, vtable.vncServer.0
jne 0x4721c8
mov eax, dword [ecx + 0xe4]
test eax, eax
je 0x472158
cmp byte [0x55ab74], 0
je 0x472151
cmp byte [0x55ab01], 0
je 0x472151
mov eax, dword [0x55898c]
test eax, eax
je 0x472151
push 2
push 0
push eax
push 0x4b
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x4720a7
call esi
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_restore_SPI_value_for_SPI_SETFONTSMOOTHING__0x_08x__n
push 8
jmp 0x472144
push dword [0x55898c]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restored_SPI_value_for_SPI_SETFONTSMOOTHING:_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
cmp byte [0x55ab02], 0
je 0x472109
push 2
push dword [0x558988]
push 0
push 0x1049
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x4720ef
call esi
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_restore_SPI_value_for_SPI_SETCLEARTYPE__0x_08x__n
push 8
jmp 0x4720fc
push dword [0x558988]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restored_SPI_value_for_SPI_SETCLEARTYPE:_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
cmp byte [0x55ab03], 0
je 0x472151
push 2
push dword [0x558990]
push 0
push 0x200b
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x472137
call esi
push eax
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Failed_to_restore_SPI_value_for_SPI_SETFONTSMOOTHINGTYPE__0x_08x__n
push 8
jmp 0x472144
push dword [0x558990]
push str.d:_saasultravncwinvncwinvnchidedesktop.cpp_:_Restored_SPI_value_for_SPI_SETFONTSMOOTHINGTYPE:_0x_08x_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
mov byte [0x55ab74], 0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x218]
cmp eax, vtable.vncServer.0
jne 0x4721cf
mov eax, dword [ecx + 0xe8]
test eax, eax
je 0x472178
call fcn.00471640
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [edi + 0x1100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ecx
mov ecx, esi
call edx
jmp 0x471e31
call edx
jmp 0x471e4c
call edx
jmp 0x471f8f
call edx
jmp 0x472058
call edx
jmp 0x47216f