Function at 0x4542a0
Capabilities:
Create process on windows
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x344
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push ebp
mov ebp, dword [esp + 0x350]
push edi
mov edi, dword [esp + 0x35c]
xor ebx, ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], edi
mov dword [0x4f37b0], ebx
mov dword [0x4f37b4], ebx
call fcn.004431d0
push ebx
call fcn.0047ebfe
add eax, 0x40
push eax
call fcn.0047ffd8
add esp, 8
push str.vnclang_server.dll
mov dword [0x4f21d8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4f21d8], eax
cmp eax, ebx
jne 0x454312
mov dword [0x4f21d8], ebp
call fcn.00453e90
push 0x104
lea eax, [esp + 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x45434e
lea ecx, [esp + 0x144]
push 0x5c
push ecx
call fcn.0047c410
add esp, 8
cmp eax, ebx
jne 0x45434c
xor eax, eax
jmp 0x454b7b
mov byte [eax], bl
push esi
push 0x104
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x254]
push eax
call fcn.0047ce10
add esp, 0xc
mov byte [esp + 0x34f], bl
call fcn.0043dcb0
mov dword [0x4f21dc], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea esi, [esp + 0x18]
mov dword [0x4f2a64], eax
call fcn.00453200
cmp dword [esp + 0x18], ebx
jne 0x4543af
push ebx
push str.WinVNC
push 0x4f34d0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x454b78
push str.uvnc_service
lea ecx, [esp + 0x250]
call fcn.00406dc0
mov eax, edi
add esp, 4
xor esi, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4543d0
sub eax, edx
je 0x454403
jmp 0x4543e0
movsx ecx, byte [edi + esi]
push ecx
call fcn.0047e4d6
mov byte [edi + esi], al
mov eax, edi
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4543f6
sub eax, edx
cmp esi, eax
jb 0x4543e0
mov eax, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454410
sub eax, edx
je 0x454a92
nop
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp byte [edx + eax], 0x20
lea esi, [edx + eax]
jle 0x454a64
push 0xf
push str._settingshelper
mov ebx, 1
push esi
mov dword [esp + 0x24], ebx
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454ab5
push 0x12
push str._stopservicehelper
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454aeb
push 5
push str._kill
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454afd
push 0xd
push str._openhomepage
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454b5b
push 0xa
push str._openforum
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454b95
push 0x13
push str._startservicehelper
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454ba1
push 0xe
push str._installhelper
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454bb3
push 0x10
push str._uninstallhelper
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454bc5
push 0x15
push str._securityeditorhelper
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454bd7
push 0xf
push 0x4a8504
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454be9
push 9
push 0x4a845c
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454c8c
push 0xc
push 0x4a847c
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454cb9
push 0xd
push 0x4a84a0
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454cc3
push 8
push 0x4a84b0
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454ccd
push 0xa
push 0x4a84bc
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454db1
push 0xc
push str._service_run
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454e92
push 8
push str._service
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454ec3
push 4
push 0x4a83f0
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
je 0x454ed1
push 8
push str._sc_exit
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x454612
add dword [esp + 0x10], 8
mov dword [0x4f37b0], ebx
jmp 0x454a64
push 0xa
push str._sc_prompt
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x454636
add dword [esp + 0x10], 0xa
mov dword [0x4f37b4], ebx
jmp 0x454a64
push 6
push str._multi
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x45465a
add dword [esp + 0x10], 6
mov dword [0x4f37b8], ebx
jmp 0x454a64
push 0xe
push str._autoreconnect
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x45474d
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov al, byte [esi + ebp + 0xe]
add esi, 0xe
xor edi, edi
cmp al, 0x20
mov dword [esp + 0x10], esi
jg 0x45469d
jmp 0x454690
test al, al
je 0x45469d
add esi, ebx
mov al, byte [esi + ebp]
cmp al, 0x20
jle 0x454690
push 3
lea eax, [esi + ebp]
push 0x4a8414
push eax
mov dword [esp + 0x28], eax
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x4546ff
mov ecx, dword [esp + 0x1c]
cmp byte [ecx], 0x20
mov ebx, esi
jle 0x4546ca
inc ebx
cmp byte [ebx + ebp], 0x20
jg 0x4546c3
mov ebp, ebx
sub ebp, esi
lea edx, [ebp + 1]
push edx
call fcn.0047cc97
mov edi, eax
add esp, 4
test edi, edi
je 0x4546fb
mov eax, dword [esp + 0x1c]
push ebp
push eax
push edi
call fcn.0047ce10
push edi
mov byte [edi + ebp], 0
call fcn.0047dce2
add esp, 0x10
mov edi, eax
mov dword [esp + 0x10], ebx
mov eax, edi
call fcn.00451c90
test eax, eax
jne 0x454a64
mov byte [0x4f378e], 1
test edi, edi
jne 0x45472c
mov byte [0x4f379e], 1
mov byte [0x4f378e], 0
jmp 0x454a64
mov edx, 0x4f3510
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x454735
push edi
call fcn.0047d0a1
add esp, 4
jmp 0x454a64
push 4
push str._id:
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x454808
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
cmp byte [ecx + eax], 0x20
lea ebp, [ecx + eax]
mov edi, eax
jle 0x454788
lea esp, [esp]
add edi, ebx
cmp byte [ecx + edi], 0x20
jg 0x454780
mov ebx, edi
sub ebx, eax
lea ecx, [ebx + 1]
push ecx
call fcn.0047cc97
mov esi, eax
add esp, 4
test esi, esi
je 0x4547b5
push ebx
push ebp
push esi
call fcn.0047ce10
push esi
mov byte [esi + ebx], 0
call fcn.0047dce2
add esp, 0x10
mov esi, eax
mov eax, esi
mov dword [esp + 0x10], edi
call fcn.00451ce0
test eax, eax
jne 0x454a64
mov byte [0x4f379f], 1
test esi, esi
jne 0x4547e6
mov byte [0x4f37ac], 1
mov byte [0x4f379f], 0
jmp 0x454a64
mov edx, 0x4f3510
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4547f0
push esi
call fcn.0047d0a1
add esp, 4
jmp 0x454a64
push 8
push str._connect
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x454993
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov al, byte [ecx + edi + 8]
add edi, 8
cmp al, 0x20
mov dword [esp + 0x10], edi
jg 0x454844
test al, al
je 0x454844
add edi, ebx
mov al, byte [ecx + edi]
cmp al, 0x20
jle 0x454837
mov eax, ecx
cmp byte [eax + edi], 0x20
mov ebp, edi
jle 0x454857
mov edi, edi
inc ebp
cmp byte [eax + ebp], 0x20
jg 0x454850
mov ebx, ebp
sub ebx, edi
test ebx, ebx
jle 0x454958
lea edx, [ebx + 1]
push edx
call fcn.0047cc97
mov esi, eax
add esp, 4
test esi, esi
je 0x45494f
mov eax, dword [esp + 0x14]
push ebx
add eax, edi
push eax
push esi
call fcn.0047ce10
mov ecx, esi
sub ecx, edi
push 0x3a
push esi
mov byte [ecx + ebp], 0
mov edi, 0x157c
call fcn.0047eb00
add esp, 0x14
test eax, eax
je 0x4548b8
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x4548ad
inc eax
push eax
call fcn.0047ca33
mov edi, eax
add esp, 4
push edi
push esi
push str..winvnc.cpp_:_test...__s__d_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x4548f4
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4548ec
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
jne 0x4548f0
xor ebx, ebx
jmp 0x4548f6
mov edx, dword [eax]
mov eax, dword [edx]
mov ebx, eax
push esi
call fcn.0047d0a1
add esp, 4
test ebx, ebx
je 0x45493c
push str..winvnc.cpp_:_PostAddNewClient_III__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
call fcn.00451c00
test eax, eax
jne 0x45494f
mov dword [0x4f2a60], edi
mov dword [0x4f26e0], ebx
mov byte [0x4f378f], 1
mov dword [esp + 0x10], ebp
jmp 0x454a64
xor eax, eax
mov dword [0x4f2a60], eax
mov dword [0x4f26e0], eax
mov byte [0x4f378f], 1
mov dword [esp + 0x10], ebp
jmp 0x454a64
push str..winvnc.cpp_:_PostAddNewClient_IIII_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
xor edi, edi
xor ebx, ebx
call fcn.00451c00
test eax, eax
jne 0x454a64
mov byte [0x4f378f], 1
mov dword [0x4f2a60], eax
mov dword [0x4f26e0], eax
jmp 0x454a64
push 9
push str._repeater
push esi
call fcn.0047e22e
add esp, 0xc
test eax, eax
jne 0x454ef6
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov cl, byte [edx + esi + 9]
add esi, 9
cmp cl, 0x20
mov dword [esp + 0x10], esi
mov eax, esi
jg 0x4549d3
test cl, cl
je 0x4549d3
add eax, ebx
mov cl, byte [edx + eax]
cmp cl, 0x20
jle 0x4549c5
cmp byte [edx + eax], 0x20
lea ebp, [edx + eax]
mov edi, eax
jle 0x4549e8
mov edi, edi
add edi, ebx
cmp byte [edx + edi], 0x20
jg 0x4549e0
mov esi, edi
sub esi, eax
test esi, esi
jle 0x454a64
mov eax, dword [0x4f37a4]
xor ebx, ebx
cmp eax, ebx
je 0x454a0a
push eax
call fcn.0047d0a1
add esp, 4
mov dword [0x4f37a4], ebx
lea eax, [esi + 1]
push eax
call fcn.0047cc97
add esp, 4
mov dword [0x4f37a4], eax
cmp eax, ebx
je 0x454a60
push esi
push ebp
push eax
call fcn.0047ce10
mov ecx, dword [0x4f37a4]
mov byte [ecx + esi], bl
push str..winvnc.cpp_:_PostAddNewRepeaterClient_I_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 0x10
call fcn.00451c60
test eax, eax
jne 0x454a60
mov byte [0x4f37ad], 1
mov dword [0x4f2a60], ebx
mov dword [0x4f26e0], ebx
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x14]
inc dword [esp + 0x10]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454a70
sub eax, edx
cmp dword [esp + 0x10], eax
jb 0x454420
cmp dword [esp + 0x18], 0
jne 0x454b72
mov ebp, dword [esp + 0x20]
mov eax, ebp
call fcn.00454210
test al, al
je 0x454b72
call fcn.00455360
mov esi, eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, esi
jmp 0x454b7a
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea eax, [edx + eax + 0x10]
lea edx, [esp + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x454ad2
lea ecx, [esp + 0x24]
call fcn.004054d0
jmp 0x454b72
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406950
jmp 0x454b72
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x4f4094], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x4f4094]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x454b72
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push esi
call edi
push 0
push 0
push 0x10
push esi
call edi
jmp 0x454b72
push ebx
push 0
push 0
push str.http:__www.uvnc.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.WSOCK32.dll_WSACleanup]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x34c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c3ff
add esp, 0x344
ret 0x10
push ebx
push 0
push 0
push str.http:__forum.uvnc.com
jmp 0x454b65
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406a40
jmp 0x454b72
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406b30
jmp 0x454b72
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406bc0
jmp 0x454b72
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406c50
jmp 0x454b72
push 0x104
lea edx, [esp + 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x454c41
lea eax, [esp + 0x24]
push 0x5c
push eax
call fcn.0047c410
mov byte [eax], 0
lea eax, [esp + 0x2c]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x454c16
mov ecx, dword [str._authSSP.dll]
mov edx, dword [0x4affec]
mov dword [eax], ecx
mov ecx, dword [0x4afff0]
mov dword [eax + 4], edx
mov dl, byte [0x4afff4]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x454b72
push str.vncEditSecurity
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x4f21dc]
push ecx
push 0
call edi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x454b72
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea eax, [edx + eax + 0xa]
lea edx, [esp + 0x24]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x454ca0
lea ecx, [esp + 0x24]
call fcn.004055d0
jmp 0x454b72
call fcn.004069e0
jmp 0x454b72
call fcn.00406ad0
jmp 0x454b72
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov al, byte [ecx + edx]
lea esi, [ecx + edx]
test al, al
je 0x454d73
movsx eax, al
push eax
call fcn.0048025b
add esp, 4
test eax, eax
jne 0x454cfe
mov al, byte [esi + ebx]
add esi, ebx
test al, al
jne 0x454ce3
jmp 0x454d73
mov al, byte [esi]
test al, al
je 0x454d73
movsx ecx, al
push ecx
call fcn.0048025b
add esp, 4
test eax, eax
je 0x454d1f
mov al, byte [esi + ebx]
add esi, ebx
test al, al
jne 0x454d04
jmp 0x454d73
mov al, byte [esi]
test al, al
je 0x454d73
cmp al, 0x22
jne 0x454d2b
add esi, ebx
cmp byte [esi], 0
je 0x454d73
push 0x22
push esi
call fcn.0047c410
add esp, 8
test eax, eax
je 0x454d42
mov byte [eax], 0
cmp byte [esi], 0
je 0x454d73
push str.uvnc_service
push esi
call fcn.0047d85e
add esp, 8
test eax, eax
je 0x454d73
push 0x100
push esi
push str.uvnc_service
call fcn.0047ce10
add esp, 0xc
mov byte [0x4bc087], 0
call fcn.0040c860
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
lea edx, [esp + 0x2c]
push 0x124
push edx
call fcn.0047cd5d
add esp, 0x10
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x454b72
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov al, byte [ecx + edx]
lea esi, [ecx + edx]
test al, al
je 0x454e5f
movsx eax, al
push eax
call fcn.0048025b
add esp, 4
test eax, eax
jne 0x454de5
mov al, byte [esi + ebx]
add esi, ebx
test al, al
jne 0x454dc7
jmp 0x454e5f
mov al, byte [esi]
test al, al
je 0x454e5f
jmp 0x454df0
movsx ecx, al
push ecx
call fcn.0048025b
add esp, 4
test eax, eax
je 0x454e0b
mov al, byte [esi + ebx]
add esi, ebx
test al, al
jne 0x454df0
jmp 0x454e5f
mov al, byte [esi]
test al, al
je 0x454e5f
cmp al, 0x22
jne 0x454e17
add esi, ebx
cmp byte [esi], 0
je 0x454e5f
push 0x22
push esi
call fcn.0047c410
add esp, 8
test eax, eax
je 0x454e2e
mov byte [eax], 0
cmp byte [esi], 0
je 0x454e5f
push str.uvnc_service
push esi
call fcn.0047d85e
add esp, 8
test eax, eax
je 0x454e5f
push 0x100
push esi
push str.uvnc_service
call fcn.0047ce10
add esp, 0xc
mov byte [0x4bc087], 0
push str.uvnc_service
push str.net_stop___s_
lea edx, [esp + 0x2c]
push 0x124
push edx
call fcn.0047cd5d
add esp, 0x10
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.0040c940
jmp 0x454b72
mov eax, dword [esp + 0x20]
call fcn.00454210
test al, al
je 0x454b72
mov dword [0x4f37a0], ebx
mov dword [0x4f3794], ebx
call fcn.00455360
mov esi, eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, esi
jmp 0x454b7a
mov eax, dword [esp + 0x14]
call fcn.0040c750
jmp 0x454b72
mov eax, dword [esp + 0x20]
call fcn.00454210
test al, al
je 0x454b72
call fcn.00455360
mov esi, eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, esi
jmp 0x454b7a
push 0x40
push 0x4f3170
push str.winvnc___sc_prompt____sc_exit____id:________autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____run__n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x454b72