Function at 0x418936
Capabilities:
Create directory
Encrypt data using speck
Enumerate files on windows
Get disk information
Hash data using murmur3
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x471635
mov eax, dword fs:[0]
push eax
sub esp, 0xdb8
mov eax, dword [0x48ea40]
xor eax, esp
mov dword [esp + 0xdb0], eax
push ebx
push esi
push edi
mov eax, dword [0x48ea40]
xor eax, esp
push eax
lea eax, [esp + 0xdc8]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
mov esi, ecx
call edx
mov edx, dword [esi]
movsx eax, ax
push eax
mov eax, dword [edx + 0x3c]
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_connected_:__s___hd__n
push 1
push 0x490660
call fcn.00401810
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov ecx, dword [ebx + 0x60]
push 0x7530
mov dword [esp + 0xf8], eax
call fcn.00449a80
xor esi, esi
test eax, eax
jne 0x4165f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.._vncclient.cpp_:_failed_to_set_socket_timeout__d__n
push esi
push 0x490660
call fcn.00401810
add esp, 0x10
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
test eax, eax
je 0x41a0de
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
mov ecx, dword [ebx + 0x60]
push str.._vncclient.cpp_:_DSMPlugin_Pointer_to_socket_OK_n
push 9
push 0x490660
mov dword [ecx + 8], eax
call fcn.00401810
mov ecx, dword [ebx + 0x64]
mov edi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
add esp, 0xc
add edi, 0x17c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [edi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
cmp byte [eax + 0x21], 0
je 0x4166ab
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jbe 0x416677
push str.._vncclient.cpp_:_A_connection_using_DSM_already_exist___client_rejected_to_avoid_crash__n
push 1
jmp 0x41a0e5
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jne 0x416699
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x208]
call edx
mov ecx, eax
call fcn.00403010
mov eax, dword [ebx + 0x60]
mov byte [eax + 0xc], 1
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x6c], esi
jmp 0x4166b8
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x6c], 1
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
mov ecx, ebx
call edx
test eax, eax
jne 0x41670b
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x230]
call edx
test eax, eax
je 0x41a0f2
push 0x457
push 0x457
call fcn.004480c0
add esp, 8
jmp 0x41a0f2
push str.._vncclient.cpp_:_negotiated_version_n
push 9
push 0x490660
call fcn.00401810
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
add esp, 0xc
mov ecx, ebx
call edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
test eax, eax
mov eax, dword [ebx + 0x64]
jne 0x41674b
mov esi, dword [eax]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
jmp 0x41a0f2
mov edi, dword [eax]
mov eax, dword [edx + 0x3c]
add edi, 0x180
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [edi]
push eax
call edx
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b8]
call edx
imul eax, eax, 0x3e8
mov ecx, dword [ebx + 0x60]
push eax
call fcn.00449a80
push str.._vncclient.cpp_:_authenticated_connection_n
push 9
push 0x490660
call fcn.00401810
mov eax, dword [ebx + 0x68]
mov edi, dword [eax]
add esp, 0xc
add edi, 0x68
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebx + 0x68]
mov edx, dword [edi]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1cc]
mov dword [esp + 0xdd0], esi
call edx
push eax
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
call fcn.0040f780
push edi
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebx + 0x68]
lea ecx, [esp + 0x128]
push ecx
mov ecx, dword [edx + 0xcc]
call fcn.0040edc0
mov ecx, dword [ebx + 0x68]
mov edx, dword [eax]
add ecx, 0x464
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0xcc]
call fcn.0040edb0
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x474], eax
push 0x110
lea eax, [esp + 0x440]
push esi
push eax
mov dword [esp + 0x7c], 0x110
call fcn.0045c220
add esp, 0xc
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4168df
lea eax, [esp + 0x43c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416880
sub eax, edx
je 0x4168c4
lea ecx, [ecx]
movsx eax, byte [esp + esi + 0x43c]
push eax
call fcn.0045ec1e
mov byte [esp + esi + 0x440], al
lea eax, [esp + 0x440]
add esp, 4
add esi, 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4168b5
sub eax, edx
cmp esi, eax
jb 0x416890
lea ecx, [esp + 0x43c]
push 0x2e
push ecx
call fcn.0045e137
add esp, 8
test eax, eax
je 0x416907
jmp 0x4169dd
mov edx, dword [0x478710]
mov ax, word [0x478714]
mov cl, byte [0x478716]
mov dword [esp + 0x43c], edx
mov word [esp + 0x440], ax
mov byte [esp + 0x442], cl
lea edx, [esp + 0x22c]
push pe_nt_image_headers32
push edx
call fcn.00437e10
lea eax, [esp + 0x234]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416926
sub eax, edx
cmp eax, 3
jbe 0x4169dd
mov al, byte [esp + 0x22c]
cmp al, 0x49
je 0x4169dd
cmp al, 0x48
je 0x4169dd
lea edi, [esp + 0x43c]
add edi, 0xffffffff
jmp 0x416960
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x416960
mov eax, dword [0x47870c]
mov dword [edi], eax
lea eax, [esp + 0x22c]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416980
lea edi, [esp + 0x43c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x416995
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x43c]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4169c0
mov cx, word [0x478708]
mov dl, byte [0x47870a]
mov word [eax], cx
mov byte [eax + 2], dl
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0xcc]
lea eax, [esp + 0x128]
push eax
call fcn.0040ee10
mov edx, dword [eax]
mov dword [esp + 0x98], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x9c], ecx
mov edx, dword [eax + 8]
mov dword [esp + 0xa0], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0xa4], eax
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x46c]
sub ecx, dword [eax + 0x464]
movzx dx, ch
movzx ecx, word [eax + 0x46c]
sub cx, word [eax + 0x464]
shl cx, 8
xor dx, cx
mov word [esp + 0x94], dx
mov edx, dword [eax + 0x470]
sub edx, dword [eax + 0x468]
movzx cx, dh
movzx edx, word [eax + 0x470]
sub dx, word [eax + 0x468]
mov ax, word [esp + 0x9c]
shl dx, 8
xor cx, dx
movzx edx, word [esp + 0xa0]
mov word [esp + 0x96], cx
movzx ecx, word [esp + 0x9e]
rol ax, 8
rol cx, 8
rol dx, 8
mov word [esp + 0x9c], ax
lea eax, [esp + 0x43c]
mov word [esp + 0xa0], dx
mov word [esp + 0x9e], cx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416ac0
sub eax, edx
lea edi, [esp + 0x43c]
mov ecx, eax
lea edx, [edi + 1]
mov al, byte [edi]
add edi, 1
test al, al
jne 0x416ad7
lea eax, [esp + 0x43c]
sub edi, edx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x416af0
sub eax, esi
mov esi, eax
lea eax, [esp + 0x43c]
lea edx, [eax + 1]
mov dword [esp + 0x4c], edx
jmp 0x416b10
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x416b10
sub eax, dword [esp + 0x4c]
shr ecx, 0x10
shl eax, 0x10
and edi, 0xff0000
and esi, 0xff00
or eax, esi
or edi, ecx
mov ecx, dword [ebx + 0x60]
shl eax, 8
shr edi, 8
or eax, edi
mov dword [esp + 0xa8], eax
push 0x18
lea eax, [esp + 0x98]
push eax
call fcn.00449cc0
test eax, eax
jne 0x416b77
mov ecx, dword [ebx + 0x64]
mov esi, dword [ecx]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
jmp 0x41a0f2
lea eax, [esp + 0x43c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x416b81
mov ecx, dword [ebx + 0x60]
sub eax, edx
push eax
lea eax, [esp + 0x440]
push eax
call fcn.00449cc0
test eax, eax
je 0x416b58
push str.._vncclient.cpp_:_sent_pixel_format_to_client_n
push 9
push 0x490660
call fcn.00401810
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
add esp, 0xc
call edx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
push edi
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x68]
add eax, 0x464
mov esi, 1
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0xdd4], esi
call fcn.00407370
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0x11c]
mov edx, dword [edx + 4]
add ecx, 0x11c
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xdd4], 2
call edx
lea ecx, [esp + 0x24]
mov byte [esp + 0xdd0], 1
call fcn.004070e0
push edi
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 2
mov ecx, ebx
call fcn.0045b790
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x120]
mov dword [esp + 0x1c], esi
call edx
movzx eax, al
mov dword [esp + 0x90], eax
mov byte [esp + 0x2b], 1
mov byte [esp + 0x23], 0
mov byte [esp + 0x2a], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
test al, al
jne 0x416c93
call fcn.00447d60
test eax, eax
jne 0x416c93
push eax
call fcn.00447c70
add esp, 4
test eax, eax
je 0x417be2
mov ecx, dword [ebx + 0x68]
cmp dword [ecx + 0x38], 0
je 0x416cbc
cmp byte [esp + 0x2b], 0
je 0x416cbc
push 0x14
call fcn.00412820
push 0x91
call fcn.00412820
add esp, 8
mov byte [esp + 0x2b], 0
cmp dword [esp + 0x90], 0
je 0x416cf0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x120]
call eax
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xcc]
mov ecx, dword [edx + 0x54]
push eax
call fcn.0041e340
mov dword [esp + 0x90], 0
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
mov ecx, dword [ecx + 0x54]
mov dl, byte [ecx + 0xe1e0]
mov byte [esp + 0x11c], dl
mov eax, dword [esp + 0x11c]
push eax
call fcn.0041d530
cmp byte [esp + 0x23], 0
je 0x416d2c
mov ecx, dword [ebx + 0x68]
push 0
call fcn.00413960
mov byte [esp + 0x23], 0
cmp byte [esp + 0x2a], 0
je 0x416d40
mov ecx, dword [ebx + 0x68]
call fcn.004139d0
mov byte [esp + 0x2a], 0
mov ecx, dword [ebx + 0x60]
cmp byte [ecx + 0xc], 0
mov edi, 1
je 0x416d7e
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x208]
call eax
cmp byte [eax + 0x21], 0
je 0x416d7e
push edi
lea ecx, [esp + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je 0x417be2
xor edi, edi
jmp 0x416d98
mov ecx, dword [ebx + 0x60]
push 1
lea edx, [esp + 0x1e8]
push edx
call fcn.00449e10
test eax, eax
je 0x417be2
movzx eax, byte [esp + 0x1e4]
cmp eax, 0xf
ja case.0x416da9.1
jmp dword [eax*4 + 0x41a118]
mov eax, 0x2c
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.1
lea edx, [esp + 0x1e8]
push edx
call fcn.00410fb0
movzx eax, al
push eax
push str.._vncclient.cpp_:_rfbSecureCheck:_result_d_n
push 9
push 0x490660
mov dword [esp + 0x30], eax
call fcn.00401810
add esp, 0x14
jmp case.0x416da9.13
mov eax, 0x14
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.1
mov dx, word [esp + 0x1ec]
mov ax, word [esp + 0x1ee]
mov cx, word [esp + 0x1f0]
rol dx, 8
rol ax, 8
mov word [esp + 0x1ec], dx
rol cx, 8
xor edx, edx
cmp byte [esp + 0x1f5], 1
mov word [esp + 0x1ee], ax
mov eax, dword [ebx + 0x68]
sete dl
mov word [esp + 0x1f0], cx
mov ecx, dword [eax + 0xcc]
push edx
call fcn.0040f210
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
lea ecx, [esp + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x68]
add ecx, 0x50
call fcn.00410bf0
test eax, eax
jne 0x416eb2
push str.._vncclient.cpp_:_remote_pixel_format_invalid_n
push eax
push 0x490660
call fcn.00401810
add esp, 0xc
mov dword [esp + 0x1c], 0
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x144], 1
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x48]
call edx
jmp case.0x416da9.13
mov eax, 4
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
add eax, 0x50
xor esi, esi
push esi
mov dword [eax + 0x70], esi
call fcn.0040f220
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x60], esi
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x64], esi
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x68], esi
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x4c], 0xffffffff
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x416f3d
push 0xffffffffffffffff
mov ecx, eax
call fcn.004250a0
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x48], 6
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x416f5a
push 6
mov ecx, eax
call fcn.00425080
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x50], esi
mov eax, dword [eax + 0x20]
cmp eax, esi
je 0x416f6d
mov dword [eax + 0x64], esi
mov ecx, dword [ebx + 0x68]
push esi
add ecx, 0x50
call fcn.00410d80
mov ecx, dword [ebx + 0x68]
push esi
add ecx, 0x50
call fcn.00410da0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push esi
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x160], esi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x164], esi
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
call edx
mov ax, word [esp + 0x1e6]
rol ax, 8
mov word [esp + 0x1e6], ax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x11c]
lea ecx, [eax + 0x11c]
mov eax, dword [edx + 0x10]
push esi
mov dword [esp + 0x18], esi
call eax
cmp word [esp + 0x1e6], si
mov dword [esp + 0x24], esi
mov esi, 1
jbe 0x4173a9
push 4
lea ecx, [esp + 0x6c]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je 0x417396
mov ecx, dword [esp + 0x68]
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
shl edx, 0x10
mov edi, ecx
and edi, 0xff00
or edx, edi
shr eax, 8
shl edx, 8
or eax, edx
cmp eax, esi
jne 0x41704d
mov eax, dword [ebx + 0x68]
lea ecx, [eax + 0x11c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push esi
call edx
jmp 0x41737a
cmp eax, 0xffffff21
jne 0x417062
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x150], esi
jmp 0x41737a
cmp eax, 0xffff0001
jne 0x417097
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
add eax, 0x50
push esi
mov dword [eax + 0x70], esi
call fcn.0040f220
push str.._vncclient.cpp_:_Cache_protocol_extension_enabled_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffff0006
jne 0x4170c0
mov eax, dword [ebx + 0x68]
push str.._vncclient.cpp_:_XOR_protocol_extension_enabled_n
add eax, 0x50
push 9
push 0x490660
mov dword [eax + 0x60], esi
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffffff00
jb 0x4170fa
cmp eax, 0xffffff09
ja 0x4170fa
mov ecx, dword [ebx + 0x68]
lea edi, [eax + 0x100]
push edi
add ecx, 0x50
call fcn.00410dc0
push edi
push str.._vncclient.cpp_:_compression_level_requested:__d_n
push 9
push 0x490660
call fcn.00401810
add esp, 0x10
jmp 0x41737a
cmp eax, 0xffffffe0
jb 0x41712d
cmp eax, 0xffffffe9
ja 0x41712d
mov ecx, dword [ebx + 0x68]
lea edi, [eax + 0x20]
push edi
add ecx, 0x50
call fcn.00410df0
push edi
push str.._vncclient.cpp_:_image_quality_level_requested:__d_n
push 9
push 0x490660
call fcn.00401810
add esp, 0x10
jmp 0x41737a
cmp eax, 0xffffff20
jne 0x417160
mov eax, dword [ebx + 0x68]
add eax, 0x50
mov dword [eax + 0x50], esi
mov eax, dword [eax + 0x20]
test eax, eax
je 0x417147
mov dword [eax + 0x64], esi
push str.._vncclient.cpp_:_LastRect_protocol_extension_enabled_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffffff10
jne 0x41719a
mov ecx, dword [ebx + 0x68]
push esi
add ecx, 0x50
call fcn.00410d80
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push esi
call eax
push str.._vncclient.cpp_:_X_style_cursor_shape_updates_enabled_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffffff11
jne 0x4171d4
mov ecx, dword [ebx + 0x68]
push esi
add ecx, 0x50
call fcn.00410da0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20c]
push esi
call eax
push str.._vncclient.cpp_:_Full_color_cursor_shape_updates_enabled_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffffff18
jne 0x4171fd
mov ecx, dword [ebx + 0x68]
push str.._vncclient.cpp_:_PointerPos_protocol_extension_enabled_n
push 9
push 0x490660
mov dword [ecx + 0x16c], esi
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffff8000
jne 0x417231
mov edx, dword [ebx + 0x68]
push str.._vncclient.cpp_:_ServerState_protocol_extension_enabled_n
mov byte [edx + 0x4d0], 1
mov eax, dword [ebx + 0x64]
push 9
push 0x490660
mov byte [eax + 0x540], 1
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffff8001
jne 0x41726a
mov eax, dword [ebx + 0x68]
push str.._vncclient.cpp_:_KeepAlive_protocol_extension_enabled_n
mov byte [eax + 0x4d2], 1
mov eax, dword [ebx + 0x64]
push 9
push 0x490660
mov byte [eax + 0x541], 1
mov byte [esp + 0x2f], 1
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0xffff8002
jne 0x41728f
push str.._vncclient.cpp_:_FTProtocolVersion_protocol_extension_enabled_n
push 9
push 0x490660
mov byte [esp + 0x36], 1
call fcn.00401810
add esp, 0xc
jmp 0x41737a
cmp eax, 0x10
jne 0x4172b5
mov eax, dword [ebx + 0x68]
push str.._vncclient.cpp_:_ZRLE_found__n
add eax, 0x50
push 9
push 0x490660
mov dword [eax + 0x64], esi
call fcn.00401810
mov ecx, dword [esp + 0x74]
add esp, 0xc
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 7
jne 0x4172fb
mov eax, dword [ebx + 0x68]
push str.._vncclient.cpp_:_Tight_found_n
add eax, 0x50
push 9
push 0x490660
mov dword [eax + 0x68], esi
call fcn.00401810
add esp, 0xc
cmp dword [esp + 0x14], 0
jne 0x41737a
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x108]
call fcn.00402df0
mov eax, dword [esp + 0x68]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
shl edx, 8
or ecx, edx
push 0
push ecx
mov ecx, dword [ebx + 0x68]
add ecx, 0x50
mov dword [esp + 0xdd8], 3
call fcn.00413a10
test eax, eax
je 0x417361
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x104]
push eax
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x24]
movzx ecx, word [esp + 0x1e6]
add eax, esi
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x416ff3
jmp 0x41739e
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x14], 0
jne 0x417426
push str.._vncclient.cpp_:_defaulting_to_raw_encoder_n
push 9
push 0x490660
call fcn.00401810
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
add esp, 0xc
call eax
push eax
lea ecx, [esp + 0x128]
call fcn.00402df0
mov ecx, dword [ebx + 0x68]
push 0
push 0
add ecx, 0x50
mov dword [esp + 0xdd8], 4
call fcn.00413a10
test eax, eax
jne 0x41740d
push str.._vncclient.cpp_:_failed_to_select_raw_encoder__n
push eax
push 0x490660
call fcn.00401810
add esp, 0xc
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x124]
push ecx
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, esi
jbe 0x417441
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x214]
call eax
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x30], esi
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
xor ecx, ecx
cmp byte [eax + 0xe1e0], cl
sete cl
push ecx
mov ecx, dword [ebx + 0x68]
push esi
call fcn.004138c0
jmp case.0x416da9.13
mov ecx, dword [ebx + 0x60]
mov edx, 0xa
sub edx, edi
push edx
lea eax, [esp + edi + 0x1e8]
push eax
call fcn.00449e10
test eax, eax
je case.0x416da9.1
movzx ecx, word [esp + 0x1e6]
mov eax, dword [ebx + 0x68]
mov dx, word [esp + 0x1e8]
xor edi, edi
rol cx, 8
movzx ecx, cx
mov si, word [esp + 0x1ea]
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
add ecx, dword [eax + 8]
imul ecx, dword [eax + 0x474]
rol dx, 8
mov dword [esp + 0xac], ecx
movzx edx, dx
add edx, dword [eax + 0xc]
imul edx, dword [eax + 0x474]
rol si, 8
movzx esi, si
mov dword [esp + 0xb0], edx
imul esi, dword [eax + 0x474]
add esi, ecx
movzx ecx, word [esp + 0x1ec]
rol cx, 8
movzx ecx, cx
mov dword [esp + 0xb4], esi
imul ecx, dword [eax + 0x474]
add ecx, edx
lea edx, [esp + 0xac]
mov dword [esp + 0xb8], ecx
push edx
lea ecx, [esp + 0x44]
call fcn.00407370
lea ecx, [esp + 0x40]
mov dword [esp + 0xdd0], 5
call fcn.00407260
test al, al
je 0x41758d
push str.._vncclient.cpp_:_FATAL__client_update_region_is_empty__n
push edi
push 0x490660
call fcn.00401810
add esp, 0xc
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x40]
mov dword [esp + 0xdd0], 0xffffffff
call fcn.004070e0
jmp case.0x416da9.13
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push eax
lea ecx, [esp + 0xe8]
call fcn.00402df0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x70]
push ecx
mov ecx, dword [ebx + 0x68]
add ecx, 0x140
mov byte [esp + 0xdd8], 6
call fcn.00407200
mov ecx, dword [ebx + 0x68]
push eax
add ecx, 0x140
mov byte [esp + 0xdd4], 7
call fcn.00407390
lea ecx, [esp + 0x6c]
mov byte [esp + 0xdd0], 6
call fcn.004070e0
cmp byte [esp + 0x1e5], 0
jne 0x417628
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x11c]
mov edx, dword [edx + 4]
lea ecx, [eax + 0x11c]
lea eax, [esp + 0x40]
push eax
call edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xcc]
mov ecx, dword [edx + 0x54]
lea eax, [esp + 0xac]
push eax
call fcn.0041b6a0
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
mov ecx, dword [ecx + 0x54]
call fcn.0041b6e0
mov ecx, dword [ebx + 0x68]
call fcn.00414100
mov edx, dword [esp + 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x417574
mov eax, 8
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.13
mov edi, dword [ebx + 0x68]
cmp dword [edi + 0x38], 0
je case.0x416da9.13
mov ecx, dword [esp + 0x1e8]
mov eax, ecx
mov edx, ecx
shr edx, 0x10
and eax, 0xff0000
or eax, edx
mov edx, ecx
shl edx, 0x10
and ecx, 0xff00
or edx, ecx
shl edx, 8
shr eax, 8
or eax, edx
cmp byte [esp + 0x1e5], 0
mov dword [esp + 0x1e8], eax
movzx ecx, byte [edi + 0x40]
setne dl
push ecx
push edx
push eax
call fcn.00437350
mov eax, dword [ebx + 0x68]
add esp, 0xc
mov dword [eax + 0x148], 1
jmp case.0x416da9.13
mov ecx, 6
sub ecx, edi
push ecx
mov ecx, dword [ebx + 0x60]
lea edx, [esp + edi + 0x1e8]
push edx
call fcn.00449e10
test eax, eax
je case.0x416da9.13
mov esi, dword [ebx + 0x68]
cmp dword [esi + 0x3c], 0
je case.0x416da9.13
mov ax, word [esp + 0x1e6]
mov cx, word [esp + 0x1e8]
mov edx, esi
rol ax, 8
add ax, word [edx + 0x10]
mov dword [esp + 0x14], 0x8000
add ax, word [edx + 8]
imul ax, word [edx + 0x474]
rol cx, 8
mov word [esp + 0x1e6], ax
add cx, word [edx + 0x14]
add cx, word [edx + 0xc]
imul cx, word [edx + 0x474]
mov word [esp + 0x1e8], cx
cmp ax, word [edx + 0x116]
jne 0x41776f
cmp cx, word [esi + 0x118]
je 0x417777
mov dword [esp + 0x14], 0x8001
mov al, byte [esi + 0x115]
xor al, byte [esp + 0x1e5]
test al, 1
je 0x4177c6
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4177ae
mov cl, byte [esp + 0x1e5]
and cl, 1
neg cl
sbb ecx, ecx
and ecx, 0xfffffff8
add ecx, 0x10
or dword [esp + 0x14], ecx
jmp 0x4177c6
mov dl, byte [esp + 0x1e5]
and dl, 1
neg dl
sbb edx, edx
and edx, 0xfffffffe
add edx, 4
or dword [esp + 0x14], edx
mov eax, dword [ebx + 0x68]
mov cl, byte [eax + 0x115]
mov al, byte [esp + 0x1e5]
mov dl, cl
and al, 2
and dl, 2
cmp al, dl
je 0x4177ef
neg al
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
or dword [esp + 0x14], eax
mov al, byte [esp + 0x1e5]
xor al, cl
test al, 4
je 0x41783a
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x417822
mov cl, byte [esp + 0x1e5]
and cl, 4
neg cl
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 4
or dword [esp + 0x14], ecx
jmp 0x41783a
mov dl, byte [esp + 0x1e5]
and dl, 4
neg dl
sbb edx, edx
and edx, 0xfffffff8
add edx, 0x10
or dword [esp + 0x14], edx
mov esi, dword [ebx + 0x68]
lea ecx, [esi + 0x50]
xor edi, edi
call fcn.00410e20
test eax, eax
mov al, byte [esp + 0x1e5]
je 0x417875
test al, 8
je 0x417866
test byte [esi + 0x115], 8
jne 0x417866
mov edi, 0x78
jmp 0x41788f
test al, 0x10
je 0x417897
test byte [esi + 0x115], 0x10
jne 0x417897
jmp 0x41788a
test al, 8
je 0x417886
or dword [esp + 0x14], 0x800
mov edi, 0x78
test al, 0x10
je 0x417897
mov edi, 0xffffff88
or dword [esp + 0x14], 0x800
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x164]
lea edx, [esp + 0x194]
push edx
lea edx, [esp + 0x11c]
push edx
lea edx, [esp + 0x11c]
push edx
call eax
mov eax, dword [ebx + 0x68]
cmp dword [eax + 0x18], 1
jne 0x417910
movzx eax, word [esp + 0x1e8]
mov ecx, dword [esp + 0x118]
imul eax, eax, 0xffff
cdq
add ecx, 0xffffffff
idiv ecx
mov edx, dword [esp + 0x114]
push 0
push edi
lea ecx, [edx - 1]
push eax
movzx eax, word [esp + 0x1f2]
imul eax, eax, 0xffff
cdq
idiv ecx
mov edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x417aa7
cmp dword [eax + 0x4b0], 0
je 0x4179cb
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
mov dword [esp + 0x214], 0
call esi
sub word [esp + 0x1e6], ax
push 0x4d
call esi
sub word [esp + 0x1e8], ax
push 0x4e
call esi
mov ecx, eax
movzx eax, word [esp + 0x1e6]
imul eax, eax, 0xffff
cdq
sub ecx, 1
idiv ecx
push 0x4f
mov dword [esp + 0x218], eax
call esi
mov ecx, eax
movzx eax, word [esp + 0x1e8]
imul eax, eax, 0xffff
cdq
sub ecx, 1
idiv ecx
mov edx, dword [ebx + 0x68]
push 0x1c
mov dword [esp + 0x220], edi
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x18]
or eax, 0x4000
mov dword [esp + 0x224], eax
xor eax, eax
mov dword [esp + 0x22c], eax
mov dword [esp + 0x228], eax
mov ecx, dword [edx + 0x4b0]
lea eax, [esp + 0x214]
push eax
push 1
call ecx
jmp 0x417aa7
lea edx, [esp + 0x174]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
test byte [esp + 0x14], 1
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [esp + 0x10c], 0xa
je 0x417a52
and dword [esp + 0x14], 0xffff7fff
push 0
lea eax, [esp + 0x1a4]
push eax
push 0
push 3
call esi
push 0
lea ecx, [esp + 0x124]
push ecx
push 0
push 0x70
call esi
xor eax, eax
push eax
lea edx, [esp + 0x110]
push edx
push eax
push 0x71
mov dword [esp + 0x198], 0xa
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
call esi
push 0
lea eax, [esp + 0x18c]
push eax
push 0
push 4
call esi
movzx ecx, word [esp + 0x1e8]
movzx edx, word [esp + 0x1e6]
sub ecx, dword [esp + 0x178]
sub edx, dword [esp + 0x174]
mov eax, dword [esp + 0x14]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_mouse_event]
test byte [esp + 0x14], 1
je 0x417aa7
push 0
lea ecx, [esp + 0x1a4]
push ecx
push 0
push 4
call esi
push 0
lea edx, [esp + 0x124]
push edx
push 0
push 0x71
call esi
mov eax, dword [ebx + 0x68]
mov ecx, dword [esp + 0x1e4]
mov dword [eax + 0x114], ecx
mov dx, word [esp + 0x1e8]
add eax, 0x114
mov word [eax + 4], dx
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x148], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0xcc]
mov ecx, dword [edx + 0x54]
call fcn.0041b6e0
jmp case.0x416da9.13
mov eax, 8
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.13
mov eax, dword [esp + 0x1e8]
mov edi, eax
mov edx, eax
mov ecx, eax
and edi, 0xff0000
shr edx, 0x10
shl ecx, 0x10
or edi, edx
and eax, 0xff00
or ecx, eax
shl ecx, 8
shr edi, 8
or edi, ecx
lea edx, [edi + 1]
push edx
call fcn.0045cd98
mov esi, eax
add esp, 4
test esi, esi
je case.0x416da9.13
push edi
mov byte [esi + edi], 0
mov ecx, dword [ebx + 0x60]
push esi
call fcn.00449e10
test eax, eax
push esi
jne 0x417b64
call fcn.0045d145
add esp, 4
jmp case.0x416da9.13
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0xec]
call edx
push esi
call fcn.0045d145
add esp, 4
jmp case.0x416da9.13
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x479], 1
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x479], 0
je 0x417d98
mov ecx, dword [ebx + 0x60]
mov edx, 4
sub edx, edi
push edx
lea eax, [esp + edi + 0x1e8]
push eax
call fcn.00449e10
test eax, eax
jne 0x417db8
mov dword [esp + 0x1c], 0
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x26c]
call edx
test eax, eax
je 0x417bd7
mov ecx, dword [ebx + 0x68]
call fcn.004137f0
cmp dword [esp + 0x1c], 0
jne 0x416c6b
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f9], 0
je 0x417c11
mov ecx, eax
mov byte [ecx + 0x2f8], 1
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x2f9], 0
mov edx, dword [ebx + 0x68]
cmp byte [edx + 0x456], 0
je 0x417c40
mov eax, edx
mov byte [eax + 0x455], 1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx + 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x456], 0
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.00447b80
mov eax, dword [ebx + 0x68]
add esp, 4
cmp byte [eax + 0x4d1], 0
je 0x417c76
mov edx, dword [eax + 0xcc]
mov ecx, dword [edx + 0x54]
push 0
call fcn.0041e680
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x4d1], 0
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
mov esi, ecx
call eax
mov edx, dword [esi]
movsx ecx, ax
mov eax, dword [edx + 0x3c]
push ecx
mov ecx, esi
call eax
push eax
push str.._vncclient.cpp_:_client_disconnected_:__s___hd__n
push 1
push 0x490660
call fcn.00401810
add esp, 0x14
push 0x104
lea ecx, [esp + 0x760]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x417d0d
lea edx, [esp + 0x75c]
push 0x5c
push edx
call fcn.0045e20a
mov byte [eax], 0
lea eax, [esp + 0x764]
add esp, 8
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x417ce0
mov ecx, dword [str.logging.dll]
mov edx, dword [0x4770c4]
mov dword [eax], ecx
mov ecx, dword [0x4770c8]
mov dword [eax + 4], edx
mov dl, byte [0x4770cc]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x75c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x417d46
push str.LOGEXIT
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x3c]
call eax
push eax
call edi
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0x13c]
test ecx, ecx
je 0x417d72
call fcn.004116a0
mov edx, dword [ebx + 0x68]
mov ecx, dword [edx + 0x13c]
push 0
call fcn.0045b6d0
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
mov esi, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
add esi, 0x5c
call eax
mov ecx, dword [ebx + 0x64]
mov edx, dword [esi]
push eax
call edx
mov ebx, dword [ebx + 0x64]
mov eax, dword [ebx]
mov ecx, ebx
jmp 0x4166e4
mov ecx, 4
sub ecx, edi
push ecx
mov ecx, dword [ebx + 0x60]
lea edx, [esp + edi + 0x1e8]
push edx
call fcn.00449e10
test eax, eax
je case.0x416da9.1
mov al, byte [esp + 0x1e5]
mov cl, al
sub cl, 1
cmp cl, 8
ja case.0x416da9.13
movzx edx, al
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x474], edx
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x90]
call fcn.00402df0
movzx ecx, byte [esp + 0x1e5]
mov edx, dword [ebx + 0x68]
push ecx
mov ecx, dword [edx + 0xcc]
mov dword [esp + 0xdd4], 8
call fcn.0040f780
test eax, eax
jne 0x417e38
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
push eax
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x416da9.13
mov ecx, dword [ebx + 0x68]
push 1
push 0
push 0
mov byte [ecx + 0x478], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebx + 0x68]
call fcn.00414100
mov edx, dword [esp + 0x8c]
push edx
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x416da9.13
mov eax, 4
sub eax, edi
push eax
lea ecx, [esp + edi + 0x1e8]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
je case.0x416da9.1
mov edx, dword [ebx + 0x68]
cmp dword [edx + 0x38], 0
je case.0x416da9.13
cmp byte [esp + 0x1e5], 1
mov eax, str.disabled
je 0x417eb5
mov eax, str.enabled
push eax
push str.._vncclient.cpp_:_rfbSetServerInput:_inputs__s_n
push 9
push 0x490660
call fcn.00401810
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
add esp, 0x10
call edx
cmp byte [eax + 0xe1e0], 0
je 0x417f0e
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x4d1], 0
jne 0x417f0e
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
xor ecx, ecx
cmp byte [eax + 0xe1e0], cl
sete cl
push ecx
mov ecx, dword [ebx + 0x64]
push 1
call fcn.00446140
jmp case.0x416da9.13
cmp byte [esp + 0x1e5], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
mov ecx, dword [ecx + 0x54]
sete dl
push edx
call fcn.0041e680
cmp byte [esp + 0x1e5], 1
mov eax, dword [ebx + 0x68]
sete dl
mov byte [eax + 0x4d1], dl
jmp case.0x416da9.13
mov ecx, 6
sub ecx, edi
push ecx
mov ecx, dword [ebx + 0x60]
lea edx, [esp + edi + 0x1e8]
push edx
call fcn.00449e10
test eax, eax
je case.0x416da9.1
mov ax, word [esp + 0x1e6]
mov cx, word [esp + 0x1e8]
rol ax, 8
movzx esi, ax
cmp si, 5
jae 0x417fa8
mov dx, cx
rol dx, 8
cmp dx, 5
jae 0x417fa8
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0xcc]
mov ecx, dword [ecx + 0x54]
push 1
push 1
call fcn.0041cd50
jmp case.0x416da9.13
mov eax, dword [ebx + 0x68]
mov edx, dword [eax + 0x474]
rol cx, 8
movzx ecx, cx
add ecx, dword [eax + 0x14]
movzx esi, si
add ecx, dword [eax + 0xc]
imul ecx, edx
push ecx
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
add ecx, esi
imul ecx, edx
mov edx, dword [eax + 0xcc]
push ecx
mov ecx, dword [edx + 0x54]
call fcn.0041cd50
jmp case.0x416da9.13
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x4a0]
push edi
call fcn.0040b280
jmp case.0x416da9.13
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x26c]
mov byte [esp + 0x13], 1
call eax
test eax, eax
je 0x41801a
mov ecx, dword [ebx + 0x68]
call fcn.00413600
mov byte [esp + 0x13], al
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x4c]
call fcn.00402df0
mov ecx, dword [ebx + 0x68]
mov edx, 0xc
sub edx, edi
push edx
lea eax, [esp + edi + 0x1e8]
mov dword [ecx + 0x178], 1
mov ecx, dword [ebx + 0x60]
push eax
mov dword [esp + 0xdd8], 9
call fcn.00449e10
test eax, eax
je 0x41a034
movzx eax, byte [esp + 0x1e5]
add eax, 0xffffffff
cmp eax, 0x1b
ja case.0x418081.1
movzx ecx, byte [eax + 0x41a18c]
jmp dword [ecx*4 + 0x41a158]
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2fa], 1
jmp case.0x418081.1
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2fa], 0
jmp case.0x418081.1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x3c]
call fcn.00402df0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
mov byte [esp + 0xdd0], 0xa
call eax
test eax, eax
je 0x418128
cmp byte [esp + 0x13], 0
je 0x418128
mov eax, dword [esp + 0x1ec]
mov edi, eax
mov ecx, eax
mov edx, eax
and eax, 0xff00
and edi, 0xff0000
shl edx, 0x10
shr ecx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
or edi, ecx
push 0x144
shl edx, 8
shr edi, 8
add eax, 0x180
or edi, edx
push 0
push eax
mov dword [esp + 0x38], edi
call fcn.0045c220
add esp, 0xc
cmp edi, 0x144
jbe 0x418138
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x60]
push edi
add edx, 0x180
push edx
call fcn.00449e10
test eax, eax
jne 0x41815f
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov eax, dword [esp + 0x1e8]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
push 4
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebx + 0x60]
push eax
mov dword [esp + 0x4c], 0
call fcn.00449e10
test eax, eax
jne 0x4181b8
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov eax, dword [esp + 0x44]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
shr ecx, 8
shl edx, 8
add eax, 0x180
or ecx, edx
push 0x2c
push eax
mov dword [esp + 0x2c], ecx
call fcn.0045e20a
add esp, 8
test eax, eax
jne 0x418206
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2c4], 0
jmp 0x418222
mov ecx, dword [ebx + 0x68]
lea esi, [eax + 1]
add ecx, 0x2c4
mov dl, byte [esi]
mov byte [ecx], dl
add esi, 1
add ecx, 1
test dl, dl
jne 0x418212
mov byte [eax], dl
mov edi, dword [ebx + 0x68]
add edi, 0x180
lea esi, [esp + 0x1c8]
call fcn.00415c60
cmp dword [eax + 0x18], 0x10
jb 0x418242
mov edx, dword [eax + 4]
jmp 0x418245
lea edx, [eax + 4]
mov ecx, dword [ebx + 0x68]
add ecx, 0x180
mov edi, edi
mov al, byte [edx]
mov byte [ecx], al
add edx, 1
add ecx, 1
test al, al
jne 0x418250
lea ecx, [esp + 0x1c8]
call fcn.00404e00
mov ecx, dword [ebx + 0x68]
xor edi, edi
push edi
push 0x8000000
push 4
push edi
push 3
push 0xc0000000
add ecx, 0x180
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2e0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, dword [ebx + 0x68]
sete byte [esp + 0x13]
xor ecx, ecx
cmp dword [eax + 0x2e0], 0xffffffff
mov eax, dword [esp + 0x2c]
setne cl
add eax, 0x41
push eax
mov dword [esp + 0x30], eax
sub ecx, 1
mov dword [esp + 0x18], ecx
call fcn.0045cd98
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x4182e5
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov eax, dword [esp + 0x2c]
push eax
push edi
push esi
call fcn.0045c220
mov eax, dword [ebx + 0x68]
add esp, 0xc
add eax, 0x180
mov edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x418300
push 0x5c
push esi
call fcn.0045e20a
add esp, 8
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x41835e
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x168]
push edx
lea ecx, [esp + 0x164]
push ecx
push esi
call eax
test eax, eax
jne 0x41835e
mov dword [esp + 0x14], 0xffffffff
push esi
call fcn.0045d145
add esp, 4
mov ecx, 0xa
mov eax, dword [esp + 0x15c]
mov edx, dword [esp + 0x160]
shrd eax, edx, cl
sar edx, cl
push 1
push edi
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x2c]
push edi
push edx
mov esi, eax
call fcn.0045c4a0
xor ecx, ecx
add eax, dword [esp + 0x18]
push edi
push 0x3e8
adc edx, ecx
push edx
push eax
call fcn.0045c4e0
xor ecx, ecx
cmp ecx, edx
jg 0x4183bc
jl 0x4183b4
cmp esi, eax
jae 0x4183bc
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 0x14]
push 0x2400
call fcn.0045cd98
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2d8], eax
mov eax, dword [ebx + 0x68]
add esp, 4
cmp dword [eax + 0x2d8], edi
jne 0x4183e8
or esi, 0xffffffff
mov dword [esp + 0x14], esi
push 0x2000
call fcn.0045cd98
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2dc], eax
mov edx, dword [ebx + 0x68]
add esp, 4
cmp dword [edx + 0x2dc], edi
jne 0x418410
or esi, 0xffffffff
mov dword [esp + 0x14], esi
cmp byte [esp + 0x13], 0
mov byte [esp + 0x74], 7
je 0x418518
cmp esi, 0xffffffff
je 0x418518
mov ecx, dword [ebx + 0x68]
lea eax, [esp + 0x17c]
push eax
lea edx, [ecx + 0x180]
push edx
call fcn.00413570
test al, al
je 0x418518
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x180]
shrd eax, ecx, 0xd
mov esi, eax
lea esi, [esi*4 + 0x400]
push esi
shr ecx, 0xd
mov dword [esp + 0x1c], esi
call fcn.0045cd98
add esp, 4
cmp eax, edi
mov dword [esp + 0x2c], eax
je 0x418514
mov ecx, dword [ebx + 0x68]
push esi
mov edx, eax
mov eax, dword [ecx + 0x2e0]
push edx
push eax
call fcn.00413150
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x418514
xor eax, eax
mov ah, byte [esp + 0x1a]
mov ecx, esi
shl ecx, 0x10
mov edx, esi
and edx, 0xff00
or ecx, edx
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0x24]
shr esi, 0x18
or ecx, esi
mov dword [esp + 0x78], ecx
mov ecx, eax
shl ecx, 0x10
mov edx, eax
and edx, 0xff00
or ecx, edx
xor edx, edx
mov dh, byte [esp + 0x26]
shl ecx, 8
shr eax, 0x18
push 7
push 0xc
mov byte [esp + 0x7d], 0xc
or ecx, edx
or ecx, eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x84], ecx
mov ecx, dword [ebx + 0x60]
push eax
call fcn.0044a1f0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [ebx + 0x60]
push edx
call fcn.00449cc0
mov esi, dword [esp + 0x14]
mov eax, esi
and eax, 0xff0000
mov ecx, esi
mov edx, esi
shl edx, 0x10
and esi, 0xff00
shr ecx, 0x10
or eax, ecx
or edx, esi
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x68]
lea esi, [eax + 0x180]
mov eax, esi
mov byte [esp + 0x75], 9
mov dword [esp + 0x18], esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418556
sub eax, edx
mov ecx, esi
mov dword [esp + 0x2c], eax
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x418570
sub ecx, edx
lea edx, [esi + 1]
mov edi, edi
mov al, byte [esi]
add esi, 1
test al, al
jne 0x418580
sub esi, edx
mov edx, esi
mov esi, dword [esp + 0x18]
lea eax, [esi + 1]
mov dword [esp + 0x18], eax
mov al, byte [esi]
add esi, 1
test al, al
jne 0x418598
sub esi, dword [esp + 0x18]
and edx, 0xff00
mov eax, esi
shl eax, 0x10
or eax, edx
mov edx, dword [esp + 0x2c]
and ecx, 0xff0000
shr edx, 0x10
or ecx, edx
shr ecx, 8
shl eax, 8
or eax, ecx
push 7
push 0xc
lea ecx, [esp + 0x7c]
push ecx
mov ecx, dword [ebx + 0x60]
mov dword [esp + 0x88], eax
call fcn.0044a1f0
mov eax, dword [ebx + 0x68]
lea esi, [eax + 0x180]
mov eax, esi
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4185f0
sub eax, ecx
mov ecx, dword [ebx + 0x60]
push eax
push esi
call fcn.00449cc0
cmp dword [esp + 0x14], 0xffffffff
jne 0x41865a
mov edx, dword [ebx + 0x68]
add edx, 0x2e0
push edx
call fcn.0044a2c0
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0x2dc]
add esp, 4
cmp eax, edi
je 0x418634
push eax
call fcn.0045c39e
add esp, 4
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x2d8]
cmp eax, edi
je 0x41864a
push eax
call fcn.0045c39e
add esp, 4
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov eax, dword [esp + 0x1e8]
mov ecx, eax
mov edx, eax
and ecx, 0xff0000
shr edx, 0x10
or ecx, edx
mov edx, eax
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [eax + 0x2e4], ecx
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x2e4]
shr ecx, 0xd
mov dword [eax + 0x2e8], ecx
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x2ec], edi
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x2f0], edi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2f4], edi
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2fb], 0
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x2f8], 0
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x2f9], 1
mov edx, dword [ebx + 0x64]
mov eax, dword [edx + 0x544]
mov ecx, dword [ebx + 0x60]
push eax
call fcn.00449af0
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov ecx, dword [ebx + 0x68]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
push eax
lea ecx, [esp + 0x40]
call fcn.00402df0
mov eax, dword [esp + 0x1e8]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 1
mov ecx, dword [ebx + 0x68]
sete al
mov byte [ecx + 0x454], al
mov eax, dword [esp + 0x1ec]
mov edi, eax
mov edx, eax
shr edx, 0x10
and edi, 0xff0000
or edi, edx
mov edx, dword [ebx + 0x68]
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
push 0x144
or ecx, eax
xor esi, esi
add edx, 0x2fc
shl ecx, 8
push esi
shr edi, 8
push edx
mov byte [esp + 0xddc], 0xb
or edi, ecx
call fcn.0045c220
add esp, 0xc
cmp edi, 0x144
jbe 0x4187ab
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov ecx, dword [ebx + 0x68]
add ecx, 0x2fc
push edi
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449e10
test eax, eax
jne 0x4187d2
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je 0x418c1b
cmp byte [esp + 0x13], 0
je 0x418c1b
mov ecx, dword [ebx + 0x68]
lea eax, [ecx + 0x2fc]
push eax
call fcn.004160f0
cmp eax, 0xffffffff
mov eax, dword [ebx + 0x68]
jne 0x418926
lea edi, [eax + 0x2fc]
mov eax, edi
mov byte [esp + 0x138], 7
mov byte [esp + 0x139], 4
mov dword [esp + 0x13c], 0xffffffff
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418833
sub eax, edx
mov ecx, edi
mov edx, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x418845
sub ecx, esi
mov esi, edi
lea eax, [esi + 1]
mov dword [esp + 0x18], eax
lea esp, [esp]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x418860
sub esi, dword [esp + 0x18]
lea eax, [edi + 1]
mov dword [esp + 0x18], eax
mov al, byte [edi]
add edi, 1
test al, al
jne 0x418874
sub edi, dword [esp + 0x18]
and ecx, 0xff0000
mov eax, edi
shl eax, 0x10
and esi, 0xff00
shr edx, 0x10
or ecx, edx
or eax, esi
shr ecx, 8
shl eax, 8
or eax, ecx
push 7
push 0xc
lea ecx, [esp + 0x140]
push ecx
mov ecx, dword [ebx + 0x60]
mov dword [esp + 0x14c], eax
call fcn.0044a1f0
mov eax, dword [ebx + 0x68]
lea esi, [eax + 0x2fc]
mov eax, esi
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4188d0
mov ecx, dword [ebx + 0x60]
sub eax, edi
push eax
push esi
call fcn.00449cc0
mov ecx, dword [ebx + 0x60]
push 4
lea edx, [esp + 0x10c]
push edx
mov dword [esp + 0x110], 0xffffffff
call fcn.00449cc0
mov eax, dword [ebx + 0x68]
mov edx, dword [esp + 0x3c]
mov byte [eax + 0x455], 1
mov ecx, dword [ebx + 0x68]
push edx
mov byte [ecx + 0x456], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
push esi
push 0x8000000
push 3
push esi
push 1
push closesocket
add eax, 0x2fc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x440], eax
mov edx, dword [ebx + 0x68]
cmp dword [edx + 0x440], 0xffffffff
jne 0x418971
call dword [sym.imp.KERNEL32.dll_GetLastError]
or edi, 0xffffffff
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], 0xffffffff
jmp 0x418a86
mov ecx, dword [ebx + 0x68]
lea eax, [esp + 0x5c]
push eax
lea edx, [ecx + 0x2fc]
push edx
call fcn.00413570
test al, al
jne 0x4189ae
mov eax, dword [ebx + 0x68]
add eax, 0x440
push eax
call fcn.0044a2c0
add esp, 4
or edi, 0xffffffff
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], 0xffffffff
jmp 0x418a86
mov edx, dword [ebx + 0x68]
mov eax, dword [edx + 0x440]
lea ecx, [esp + 0x198]
push ecx
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, esi
je 0x418a82
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x132]
movzx ecx, word [esp + 0x130]
movzx edx, word [esp + 0x128]
push eax
movzx eax, word [esp + 0x132]
push ecx
movzx ecx, word [esp + 0x132]
push edx
push eax
push ecx
lea edx, [esp + 0x224]
push str._2.2d__2.2d__4.4d__2.2d:_2.2d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [ebx + 0x68]
add esp, 0x1c
add edi, 0x2fb
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x418a32
mov ax, word [0x478270]
mov word [edi], ax
lea eax, [esp + 0x210]
mov edi, eax
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418a50
sub eax, edi
mov edx, edi
mov edi, dword [ebx + 0x68]
add edi, 0x2fb
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x418a66
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov edi, dword [esp + 0x5c]
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x458]
cmp eax, esi
je 0x418aa5
push eax
call fcn.0045d145
mov edx, dword [ebx + 0x68]
add esp, 4
mov dword [edx + 0x458], esi
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x45c], esi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x460], esi
mov edx, edi
and edx, 0xff0000
mov eax, edi
mov ecx, edi
shr eax, 0x10
shl ecx, 0x10
or edx, eax
mov eax, dword [ebx + 0x68]
and edi, 0xff00
or ecx, edi
shr edx, 8
shl ecx, 8
or edx, ecx
add eax, 0x2fc
mov byte [esp + 0x150], 7
mov byte [esp + 0x151], 4
mov dword [esp + 0x154], edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418b00
sub eax, esi
mov edx, eax
mov eax, dword [ebx + 0x68]
lea edi, [eax + 0x2fc]
mov ecx, edi
lea esi, [ecx + 1]
jmp 0x418b20
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x418b20
sub ecx, esi
mov esi, edi
lea eax, [esi + 1]
mov dword [esp + 0x18], eax
mov al, byte [esi]
add esi, 1
test al, al
jne 0x418b34
sub esi, dword [esp + 0x18]
lea eax, [edi + 1]
mov dword [esp + 0x18], eax
mov al, byte [edi]
add edi, 1
test al, al
jne 0x418b48
sub edi, dword [esp + 0x18]
and ecx, 0xff0000
mov eax, edi
shl eax, 0x10
and esi, 0xff00
shr edx, 0x10
or ecx, edx
or eax, esi
shr ecx, 8
shl eax, 8
or eax, ecx
push 7
push 0xc
lea ecx, [esp + 0x158]
push ecx
mov ecx, dword [ebx + 0x60]
mov dword [esp + 0x164], eax
call fcn.0044a1f0
mov eax, dword [ebx + 0x68]
lea esi, [eax + 0x2fc]
mov eax, esi
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x418ba0
mov ecx, dword [ebx + 0x60]
sub eax, edi
push eax
push esi
call fcn.00449cc0
mov esi, dword [esp + 0x60]
mov edx, esi
and edx, 0xff0000
mov eax, esi
shr eax, 0x10
or edx, eax
mov ecx, esi
shl ecx, 0x10
mov eax, esi
and eax, 0xff00
or ecx, eax
shl ecx, 8
shr edx, 8
or edx, ecx
push 4
lea ecx, [esp + 0xe4]
push ecx
mov ecx, dword [ebx + 0x60]
mov dword [esp + 0xe8], edx
call fcn.00449cc0
cmp dword [esp + 0x5c], 0xffffffff
jne 0x41879b
cmp esi, 0xffffffff
jne 0x41879b
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x418081.1
mov edx, dword [ebx + 0x64]
mov eax, dword [edx + 0x544]
mov ecx, dword [ebx + 0x60]
push eax
call fcn.00449af0
mov eax, dword [esp + 0x1ec]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
shr ecx, 8
and eax, 0xff00
or edx, eax
mov eax, dword [esp + 0x1e8]
shl edx, 8
or ecx, edx
push ecx
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
push ecx
mov ecx, dword [ebx + 0x68]
call fcn.00413210
movzx eax, al
mov dword [esp + 0x1c], eax
jmp case.0x418081.1
mov eax, dword [esp + 0x1e8]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
cmp ecx, 0xffffffff
jne 0x418cfd
mov eax, dword [ebx + 0x68]
add eax, 0x440
push eax
call fcn.0044a2c0
push str.._vncclient.cpp_:__FileTransfer:_File_not_created_on_client_side._Abort___n
push 9
push 0x490660
call fcn.00401810
add esp, 0x10
jmp case.0x418081.1
push 0x2000
call fcn.0045cd98
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2d8], eax
mov edx, dword [ebx + 0x68]
xor esi, esi
add esp, 4
cmp dword [edx + 0x2d8], esi
jne 0x418d46
mov eax, edx
add eax, 0x440
push eax
call fcn.0044a2c0
push str.._vncclient.cpp_:__FileTransfer:_rfbFileHeader___Unable_to_allocate_buffer._Abort___n
push 9
push 0x490660
call fcn.00401810
add esp, 0x10
jmp case.0x418081.1
push 0x2400
call fcn.0045cd98
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2dc], eax
mov edx, dword [ebx + 0x68]
add esp, 4
cmp dword [edx + 0x2dc], esi
jne 0x418da6
mov eax, edx
add eax, 0x440
push eax
call fcn.0044a2c0
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x2d8]
add esp, 4
cmp eax, esi
je 0x418d8d
push eax
call fcn.0045c39e
add esp, 4
push str.._vncclient.cpp_:__FileTransfer:_rfbFileHeader___Unable_to_allocate_comp._buffer._Abort___n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
jmp case.0x418081.1
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x444], 0
mov eax, dword [ebx + 0x68]
mov dword [eax + 0x448], esi
mov ecx, dword [ebx + 0x68]
mov dword [ecx + 0x2f4], esi
mov edx, dword [ebx + 0x68]
mov dword [edx + 0x450], esi
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x455], 0
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x456], 1
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2fb], 0
mov ecx, dword [ebx + 0x68]
call fcn.004144a0
movzx eax, al
mov dword [esp + 0x1c], eax
jmp case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
mov eax, dword [esp + 0x1e8]
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
shr ecx, 8
and eax, 0xff00
or edx, eax
mov eax, dword [esp + 0x1ec]
shl edx, 8
or ecx, edx
push ecx
mov ecx, eax
and ecx, 0xff0000
mov edx, eax
shr edx, 0x10
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
push ecx
mov ecx, dword [ebx + 0x68]
call fcn.004163f0
mov ecx, dword [ebx + 0x68]
movzx eax, al
push 0
mov dword [esp + 0x20], eax
call fcn.00413960
jmp case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x2f9], 0
je case.0x418081.1
call fcn.00415e80
jmp case.0x418081.1
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x2f9], 0
je 0x418ef7
mov ecx, eax
mov byte [ecx + 0x2f8], 1
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x2fb], 1
mov ecx, dword [ebx + 0x68]
call fcn.00415e80
jmp case.0x418081.1
cmp byte [eax + 0x456], 0
je 0x418f19
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x455], 1
mov ecx, dword [ebx + 0x68]
mov byte [ecx + 0x2fb], 1
jmp case.0x418081.1
mov edx, dword [ebx + 0x68]
mov byte [edx + 0x47a], 1
mov eax, dword [ebx + 0x68]
cmp byte [eax + 0x47a], 0
je case.0x418081.1
cmp word [esp + 0x1e6], 0
mov byte [esp + 0xbc], 7
sete al
test al, al
je 0x418f55
mov byte [esp + 0xbd], 7
jmp 0x418f97
mov ecx, dword [ebx + 0x64]
mov byte [esp + 0xbd], 0xe
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je 0x418f97
mov ecx, dword [ebx + 0x68]
mov ecx, dword [ecx + 0xec]
mov edx, dword [ecx]
mov eax, dword [edx + 0x118]
call eax
test eax, eax
je 0x418f97
cmp byte [esp + 0x13], 0
mov dword [esp + 0xc0], 0x1000000
jne 0x418fa2
mov dword [esp + 0xc0], 0xffffffff
mov edx, dword [ebx + 0x68]
push 7
push 0xc
lea ecx, [esp + 0xc4]
push ecx
mov ecx, dword [edx + 0xf0]
call fcn.0044a1f0
mov eax, dword [ebx + 0x68]
mov byte [eax + 0x47a], 0
jmp case.0x418081.1
movzx eax, word [esp + 0x1e6]
sub eax, 1
je 0x419134
sub eax, 1
jne case.0x418081.1
lea ecx, [esp + 0x22c]
push ecx
push pe_nt_image_headers32
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x1d4]
mov dword [esp + 0x18], edi
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
lea eax, [edi - 3]
test eax, eax
jbe 0x4190c8
lea esi, [esp + 0x110]
lea ecx, [esp + 0x22c]
sub esi, ecx
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
lea eax, [esp + eax + 0x22c]
jmp 0x419050
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x419050
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x419072
jmp dword [eax*4 + 0x41a1a8]
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x22e], 0x6c
jmp case.default.0x419072
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x22e], 0x66
jmp case.default.0x419072
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x22e], 0x63
jmp case.default.0x419072
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x22e], 0x6e
mov ecx, dword [esp + 0x14]
add ecx, 4
lea eax, [edi - 3]
sub esi, 4
cmp ecx, eax
mov dword [esp + 0x14], ecx
jb 0x419040
xor eax, eax
mov ah, byte [esp + 0x1a]
mov ecx, edi
shl ecx, 0x10
mov edx, edi
and edx, 0xff00
or ecx, edx
shl ecx, 8
or ecx, eax
mov edx, edi
shr edx, 0x18
push 7
or ecx, edx
push 0xc
lea eax, [esp + 0x14c]
mov dword [esp + 0x154], ecx
mov ecx, dword [ebx + 0x60]
push eax
mov byte [esp + 0x150], 7
mov byte [esp + 0x151], 2
mov word [esp + 0x152], 3
call fcn.0044a1f0
push edi
lea ecx, [esp + 0x230]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449cc0
jmp case.0x418081.1
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov edx, eax
mov ecx, eax
shl ecx, 0x10
shr edx, 0x10
and eax, 0xff00
or edi, edx
or ecx, eax
shr edi, 8
shl ecx, 8
or edi, ecx
cmp edi, 0x104
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea edx, [esp + 0x230]
push edx
call fcn.00449e10
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov byte [esp + edi + 0x22c], 0
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
push 0xb
lea eax, [esp + 0x230]
push str.My_Documents
push eax
or esi, 0xffffffff
mov byte [esp + 0x1f], 0
call fcn.0045eaab
add esp, 0xc
test eax, eax
jne 0x4191d1
lea esi, [eax + 5]
push 7
lea ecx, [esp + 0x230]
push str.Desktop
push ecx
call fcn.0045eaab
add esp, 0xc
test eax, eax
jne 0x4191ee
xor esi, esi
push 0x11
lea edx, [esp + 0x230]
push str.Network_Favorites
push edx
call fcn.0045eaab
add esp, 0xc
test eax, eax
jne 0x41920e
lea esi, [eax + 0x13]
jmp 0x419217
cmp esi, 0xffffffff
je 0x41928c
mov ecx, dword [ebx + 0x68]
lea eax, [esp + 0x96c]
push eax
push esi
call fcn.004133d0
test al, al
je 0x419287
lea eax, [esp + 0x96c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419236
sub eax, edx
cmp byte [esp + eax + 0x96b], 0x5c
je 0x419269
lea edi, [esp + 0x96c]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x419255
mov cx, word [0x485b00]
mov word [edi], cx
xor eax, eax
jmp 0x419270
mov cl, byte [esp + eax + 0x96c]
mov byte [esp + eax + 0x22c], cl
add eax, 1
test cl, cl
jne 0x419270
jmp 0x41928c
mov byte [esp + 0x13], 1
lea edi, [esp + 0x22c]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x419296
mov dx, word [0x476ecc]
mov word [edi], dx
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov byte [esp + 0x54], 7
mov byte [esp + 0x55], 2
mov word [esp + 0x56], 1
call edi
lea eax, [esp + 0x54c]
push eax
lea ecx, [esp + 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
push 0
mov dword [esp + 0x30], esi
call edi
cmp esi, 0xffffffff
je 0x419559
cmp byte [esp + 0x13], 0
jne 0x419559
lea eax, [esp + 0x22c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419303
sub eax, edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x22c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419320
sub eax, edx
mov edx, eax
lea eax, [esp + 0x22c]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419337
sub eax, esi
mov esi, eax
lea eax, [esp + 0x22c]
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419350
mov ecx, dword [esp + 0x18]
sub eax, edi
add eax, 0xffffffff
add edx, 0xffffffff
add ecx, 0xffffffff
shl eax, 0x10
add esi, 0xffffffff
and edx, 0xff0000
shr ecx, 0x10
and esi, 0xff00
or edx, ecx
mov ecx, dword [ebx + 0x60]
or eax, esi
shr edx, 8
shl eax, 8
push 7
or eax, edx
push 0xc
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x64], eax
call fcn.0044a1f0
lea eax, [esp + 0x22c]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4193a8
mov ecx, dword [ebx + 0x60]
sub eax, esi
add eax, 0xffffffff
push eax
lea eax, [esp + 0x230]
push eax
call fcn.00449cc0
jmp 0x4193d0
test byte [esp + 0x54c], 0x10
je 0x4193f1
mov edi, 0x476ed4
lea esi, [esp + 0x578]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41940c
mov edi, 0x476ed0
lea esi, [esp + 0x578]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x419480
lea ecx, [esp + 0x578]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 0x2e
push esi
lea edx, [esp + 0x550]
push edx
lea eax, [esp + 0x764]
push eax
mov dword [esp + 0x24], esi
call fcn.0045d280
xor eax, eax
mov ah, byte [esp + 0x26]
mov ecx, esi
shl ecx, 0x10
mov edx, esi
and edx, 0xff00
or ecx, edx
shl ecx, 8
add esp, 0xc
or ecx, eax
mov edx, esi
shr edx, 0x18
push 7
or ecx, edx
push 0xc
lea eax, [esp + 0x58]
mov dword [esp + 0x60], ecx
mov ecx, dword [ebx + 0x60]
push eax
call fcn.0044a1f0
push esi
lea ecx, [esp + 0x760]
push ecx
jmp 0x41950a
mov edi, 0x476ed4
lea esi, [esp + 0x578]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x419512
lea eax, [esp + 0x578]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 0x2e
push esi
lea ecx, [esp + 0x550]
push ecx
lea edx, [esp + 0x764]
push edx
mov dword [esp + 0x24], esi
call fcn.0045d280
xor edx, edx
mov dh, byte [esp + 0x26]
mov eax, esi
shl eax, 0x10
mov ecx, esi
and ecx, 0xff00
or eax, ecx
add esp, 0xc
shl eax, 8
push 7
or eax, edx
mov ecx, esi
shr ecx, 0x18
or eax, ecx
mov ecx, dword [ebx + 0x60]
push 0xc
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x64], eax
call fcn.0044a1f0
push esi
lea eax, [esp + 0x760]
push eax
mov ecx, dword [ebx + 0x60]
call fcn.00449cc0
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x54c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4193d0
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 7
push 0xc
lea ecx, [esp + 0x58]
xor eax, eax
push ecx
mov ecx, dword [ebx + 0x60]
mov word [esp + 0x5e], ax
mov dword [esp + 0x64], eax
call fcn.0044a1f0
jmp case.0x418081.1
mov ecx, dword [ebx + 0x60]
push 7
push 0xc
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x64], 0
call fcn.0044a1f0
jmp case.0x418081.1
cmp word [esp + 0x1e6], 0
jne case.0x418081.1
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x230]
push eax
call fcn.00449e10
test eax, eax
je case.0x418081.1
lea ecx, [esp + 0x22c]
push 0x5c
push ecx
mov byte [esp + edi + 0x234], 0
call fcn.0045e137
add esp, 8
test eax, eax
jne 0x41960d
lea edx, [esp + 0x22c]
push 0x2f
push edx
call fcn.0045e137
add esp, 8
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1d4]
call edx
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
lea eax, [esp + 0x22c]
mov byte [esp + 0x80], 7
mov byte [esp + 0x81], 0x1d
mov word [esp + 0x82], 0x16
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x419651
sub eax, edx
lea ecx, [esp + 0x22c]
mov edx, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x419668
sub ecx, esi
lea esi, [esp + 0x22c]
lea edi, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x419680
sub esi, edi
lea edi, [esp + 0x22c]
lea eax, [edi + 1]
mov dword [esp + 0x18], eax
lea esp, [esp]
mov al, byte [edi]
add edi, 1
test al, al
jne 0x4196a0
sub edi, dword [esp + 0x18]
and ecx, 0xff0000
mov eax, edi
shl eax, 0x10
and esi, 0xff00
shr edx, 0x10
or ecx, edx
or eax, esi
shr ecx, 8
shl eax, 8
or eax, ecx
push 7
push 0xc
lea ecx, [esp + 0x88]
push ecx
mov ecx, dword [ebx + 0x60]
mov dword [esp + 0x94], eax
call fcn.0044a1f0
lea eax, [esp + 0x22c]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4196f2
mov ecx, dword [ebx + 0x60]
sub eax, esi
push eax
lea edx, [esp + 0x230]
push edx
call fcn.00449cc0
push 0x104
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x33c]
push ecx
call fcn.0045d150
lea edx, [esp + 0x340]
push 0x5c
push edx
call fcn.0045e20a
add esp, 0x14
test eax, eax
jne 0x419754
lea eax, [esp + 0x334]
push 0x2f
push eax
call fcn.0045e20a
add esp, 8
test eax, eax
je 0x419758
mov byte [eax + 1], 0
lea ecx, [esp + 0x22c]
push 0x5c
push ecx
call fcn.0045e20a
add esp, 8
test eax, eax
jne 0x419780
lea edx, [esp + 0x22c]
push 0x2f
push edx
call fcn.0045e20a
add esp, 8
add eax, 1
push 0x104
push eax
lea eax, [esp + 0x974]
push eax
call fcn.0045d150
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
add esp, 0xc
push 1
call esi
lea ecx, [esp + 0x54c]
push ecx
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push 0
mov dword [esp + 0x28], edi
call esi
cmp edi, 0xffffffff
je 0x4198d2
lea esp, [esp]
mov edi, 0x476ed4
lea esi, [esp + 0x578]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4198aa
mov edi, 0x476ed0
lea esi, [esp + 0x578]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4198aa
lea eax, [esp + 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x50
lea esi, [esp + 0x54c]
lea edi, [esp + 0xb7c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x334]
add eax, 0x140
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [esp + 0x338]
push edx
lea eax, [esp + 0xcc4]
push eax
call fcn.0045d280
mov esi, dword [esp + 0x38]
xor eax, eax
mov ah, byte [esp + 0x3a]
mov ecx, esi
shl ecx, 0x10
mov edx, esi
and edx, 0xff00
or ecx, edx
shl ecx, 8
add esp, 0xc
or ecx, eax
mov edx, esi
shr edx, 0x18
push 7
or ecx, edx
push 0xc
lea eax, [esp + 0x88]
mov dword [esp + 0x90], ecx
mov ecx, dword [ebx + 0x60]
push eax
call fcn.0044a1f0
push esi
lea ecx, [esp + 0xb80]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449cc0
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x54c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4197d0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
jmp 0x4198e0
mov cl, byte [esp + eax + 0x334]
mov byte [esp + eax + 0x22c], cl
add eax, 1
test cl, cl
jne 0x4198e0
lea edi, [esp + 0x22c]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x419900
mov ax, word [0x476ecc]
push 1
mov word [edi], ax
call esi
lea ecx, [esp + 0x54c]
push ecx
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
push 0
mov dword [esp + 0x28], edi
call esi
cmp edi, 0xffffffff
je 0x419a41
mov edi, 0x476ed4
lea esi, [esp + 0x578]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x419a1f
mov edi, 0x476ed0
lea esi, [esp + 0x578]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x419a1f
test byte [esp + 0x54c], 0x10
je 0x419a1f
jmp 0x419990
mov cl, byte [esp + eax + 0x334]
mov byte [esp + eax + 0x75c], cl
add eax, 1
test cl, cl
jne 0x419990
lea eax, [esp + 0x578]
mov edx, eax
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4199b0
lea edi, [esp + 0x75c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4199c5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x75c]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4199f0
mov ax, word [0x485b00]
lea ecx, [esp + 0x96c]
push ecx
lea edx, [esp + 0x760]
mov word [edi], ax
mov eax, dword [ebx + 0x60]
push edx
push eax
call fcn.00411180
add esp, 0xc
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x54c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419940
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebx + 0x60]
push 7
xor eax, eax
push 0xc
lea edx, [esp + 0x88]
push edx
mov word [esp + 0x8e], ax
mov dword [esp + 0x94], eax
call fcn.0044a1f0
jmp case.0x418081.1
movzx eax, word [esp + 0x1e6]
add eax, 0xffffffff
cmp eax, 0x10
ja case.0x418081.1
movzx eax, byte [eax + 0x41a1cc]
jmp dword [eax*4 + 0x41a1b8]
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x338]
push eax
call fcn.00449e10
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov byte [esp + edi + 0x334], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
push 0
lea ecx, [esp + 0x338]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov eax, dword [esp + 0x1ec]
mov edx, esi
neg edx
sbb edx, edx
push 7
neg edx
push 0xc
lea ecx, [esp + 0xf0]
sub edx, 1
push ecx
mov ecx, dword [ebx + 0x60]
mov byte [esp + 0xf4], 7
mov byte [esp + 0xf5], 0xb
mov word [esp + 0xf6], 4
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], eax
call fcn.0044a1f0
mov ecx, dword [ebx + 0x60]
push edi
lea edx, [esp + 0x338]
push edx
call fcn.00449cc0
test esi, esi
je case.0x418081.1
sub esp, 0x1c
lea eax, [esp + 0x350]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00405150
mov ecx, dword [ebx + 0x68]
call fcn.00414ea0
jmp case.0x418081.1
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x338]
push eax
call fcn.00449e10
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov byte [esp + edi + 0x334], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
lea ecx, [esp + 0x334]
push ecx
call fcn.00411490
add esp, 4
lea edx, [esp + 0x334]
push edx
lea ecx, [esp + 0x214]
mov byte [esp + 0x50], al
call fcn.00405150
cmp byte [esp + 0x4c], 0
mov byte [esp + 0xdd0], 0xc
je 0x419c93
lea eax, [esp + 0x334]
push eax
lea ecx, [esp + 0x1b0]
push ecx
call fcn.00415d80
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x21c]
mov byte [esp + 0xddc], 0xd
call fcn.00404ea0
lea ecx, [esp + 0x1ac]
mov byte [esp + 0xdd0], 0xc
call fcn.00404e00
mov edi, dword [esp + 0x224]
lea edx, [esp + 0x334]
push edx
add edi, 1
call fcn.00410f00
movzx esi, al
add esp, 4
mov eax, esi
neg eax
sbb eax, eax
neg eax
sub eax, 1
mov dword [esp + 0xfc], eax
mov ecx, edi
and ecx, 0xff0000
mov edx, edi
shr edx, 0x10
or ecx, edx
mov eax, edi
shl eax, 0x10
mov edx, edi
and edx, 0xff00
or eax, edx
shr ecx, 8
shl eax, 8
or ecx, eax
push 7
push 0xc
lea eax, [esp + 0x100]
mov dword [esp + 0x108], ecx
mov ecx, dword [ebx + 0x60]
push eax
mov byte [esp + 0x104], 7
mov byte [esp + 0x105], 0xb
mov word [esp + 0x106], 7
call fcn.0044a1f0
cmp dword [esp + 0x228], 0x10
mov eax, dword [esp + 0x214]
jae 0x419d35
lea eax, [esp + 0x214]
mov ecx, dword [ebx + 0x60]
push edi
push eax
call fcn.00449cc0
test esi, esi
je 0x419d66
mov ecx, dword [esp + 0x4c]
push ecx
sub esp, 0x1c
lea edx, [esp + 0x354]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.00405150
mov ecx, dword [ebx + 0x68]
call fcn.00414ec0
lea ecx, [esp + 0x210]
call fcn.00404e00
jmp case.0x418081.1
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x209
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x550]
push eax
call fcn.00449e10
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov byte [esp + edi + 0x54c], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
lea ecx, [esp + 0x54c]
push 0x2a
push ecx
call fcn.0045e20a
add esp, 8
test eax, eax
je case.0x418081.1
lea ecx, [eax + 1]
lea esi, [esp + 0x96c]
sub esi, ecx
mov dl, byte [ecx]
mov byte [ecx + esi], dl
add ecx, 1
test dl, dl
jne 0x419e14
mov byte [eax], dl
xor ecx, ecx
jmp 0x419e30
mov dl, byte [esp + ecx + 0x54c]
mov byte [esp + ecx + 0x75c], dl
add ecx, 1
test dl, dl
jne 0x419e30
lea edx, [esp + 0x96c]
mov byte [eax], 0x2a
push edx
lea eax, [esp + 0x760]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [esp + 0x1ec]
mov esi, eax
mov ecx, esi
neg ecx
sbb ecx, ecx
neg ecx
push 7
sub ecx, 1
push 0xc
lea eax, [esp + 0xd0]
mov dword [esp + 0xd4], ecx
mov ecx, dword [ebx + 0x60]
push eax
mov byte [esp + 0xd4], 7
mov byte [esp + 0xd5], 0xb
mov word [esp + 0xd6], 8
mov dword [esp + 0xdc], edx
call fcn.0044a1f0
push edi
lea ecx, [esp + 0x550]
push ecx
mov ecx, dword [ebx + 0x60]
call fcn.00449cc0
test esi, esi
je case.0x418081.1
sub esp, 0x1c
lea edx, [esp + 0x988]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00405150
sub esp, 0x1c
lea eax, [esp + 0x794]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
mov byte [esp + 0xe0c], 0xe
call fcn.00405150
mov byte [esp + 0xe08], 9
mov ecx, dword [ebx + 0x68]
call fcn.00414ee0
jmp case.0x418081.1
mov eax, dword [esp + 0x1ec]
mov edi, eax
and edi, 0xff0000
mov ecx, eax
mov edx, eax
shl edx, 0x10
shr ecx, 0x10
and eax, 0xff00
or edi, ecx
or edx, eax
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, 0x104
ja case.0x418081.1
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x338]
push eax
call fcn.00449e10
test eax, eax
je case.0x418081.1
mov ecx, dword [ebx + 0x64]
mov byte [esp + edi + 0x334], 0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1d4]
call eax
test eax, eax
je case.0x418081.1
cmp byte [esp + 0x13], 0
je case.0x418081.1
lea ecx, [esp + 0x334]
push ecx
call fcn.00411490
add esp, 4
test al, al
jne case.0x418081.1
lea edx, [esp + 0x334]
push 0
push edx
call fcn.004110f0
movzx eax, al
add esp, 8
neg eax
sbb eax, eax
neg eax
sub eax, 1
mov dword [esp + 0xd8], eax
mov eax, edi
and eax, 0xff0000
mov ecx, edi
shr ecx, 0x10
or eax, ecx
mov edx, edi
shl edx, 0x10
mov ecx, edi
and ecx, 0xff00
or edx, ecx
mov ecx, dword [ebx + 0x60]
shl edx, 8
shr eax, 8
push 7
or eax, edx
push 0xc
lea edx, [esp + 0xdc]
push edx
mov byte [esp + 0xe0], 7
mov byte [esp + 0xe1], 0xb
mov word [esp + 0xe2], 0x18
mov dword [esp + 0xe8], eax
call fcn.0044a1f0
mov ecx, dword [ebx + 0x60]
push edi
lea eax, [esp + 0x338]
push eax
call fcn.00449cc0
jmp case.0x418081.1
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x2f9], 0
je 0x41a075
mov edx, ecx
mov byte [edx + 0x2f8], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x2e0]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebx + 0x68]
add edx, 0x2e0
push edx
call fcn.0044a2c0
mov eax, dword [ebx + 0x68]
add esp, 4
mov byte [eax + 0x2f9], 0
mov ecx, dword [ebx + 0x68]
cmp byte [ecx + 0x456], 0
je case.0x418081.1
mov edx, ecx
mov byte [edx + 0x455], 1
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [ebx + 0x68]
add edx, 0x440
push edx
call fcn.0044a2c0
mov eax, dword [ebx + 0x68]
add esp, 4
mov byte [eax + 0x456], 0
mov edx, dword [esp + 0x48]
mov ecx, dword [ebx + 0x68]
push edx
mov dword [ecx + 0x178], 0
mov dword [esp + 0xdd4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x416da9.13
push str.._vncclient.cpp_:_Invalid_DSMPlugin_Pointer_n
push 9
push 0x490660
call fcn.00401810
add esp, 0xc
mov ecx, dword [esp + 0xdc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdb0]
xor ecx, esp
call fcn.0045c20d
mov esp, ebp
pop ebp
ret 4