Function at 0x14008bec0
Capabilities:
Check for foreground window switch
Check os version
Create process on windows
Delete registry value
Initialize winsock library
Resolve dns
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd80
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0xd70], rax
mov rdi, r8
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x14008bf20
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
mov rcx, rax
cmp byte [rax + 0xd], 1
jne 0x14008bfcc
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14008bfa9
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rsi, rax
test rbx, rbx
je 0x14008bfc5
test rax, rax
je 0x14008bfc5
cmp rax, rbx
je 0x14008bfc5
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Warning
lea rdx, str.Windows_XP_requires_special_build
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008bfc5
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Warning
lea rdx, str.Windows_XP_requires_special_build
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x140227bc8]
test rax, rax
jne 0x14008bfee
lea ecx, [rax + 0x30]
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.14007e8d0
nop
mov qword [0x140227bc8], rax
cmp byte [rax + 0x11], 1
jne 0x14008c0d7
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14008c074
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14008c090
test rax, rax
je 0x14008c090
cmp rax, rbx
je 0x14008c090
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Unsupported_OS
lea rdx, str.Error_OS_not_supported
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008c090
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Unsupported_OS
lea rdx, str.Error_OS_not_supported
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c0c0
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c0cd
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
mov eax, 1
jmp 0x14008e3c0
xor edx, edx
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rcx, str.SHCore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008c122
mov ecx, 2
call rax
jmp 0x14008c139
lea rdx, str.SetProcessDPIAware
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008c139
call rax
test rbx, rbx
je 0x14008c147
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x14008c155
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r13b, r13b
mov byte [rsp + 0x50], r13b
mov rax, qword [0x14022a710]
mov word [rax + 0xe2c], 0
mov ecx, 2
call fcn.14015b94c
mov rcx, rax
xor edx, edx
call fcn.140162478
xor esi, esi
mov qword [0x1402281b0], rsi
mov r8d, 0x104
lea rdx, [rsp + 0x710]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14008c1b7
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x710]
call fcn.140149b38
mov byte [rax], sil
lea r8, [rsp + 0x710]
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.140150800
lea r8, [0x1401ef4f8]
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.140150860
lea r8, str.vnclang_server.dll
mov edx, 0x104
lea rcx, [rsp + 0x600]
call fcn.140150860
lea rcx, [rsp + 0x600]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
cmove rax, r15
mov qword [0x1402281b0], rax
call fcn.14008b4d0
mov r8d, 0x104
lea rdx, [rsp + 0x820]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14008c29c
mov edx, 0x5c
lea rcx, [rsp + 0x820]
call fcn.140149b38
test rax, rax
jne 0x14008c299
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c285
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c292
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
xor eax, eax
jmp 0x14008e3c0
mov byte [rax], sil
mov r9d, 0x104
lea r8, [rsp + 0x820]
mov edx, r9d
lea rcx, [rsp + 0xa40]
call fcn.14015abcc
mov byte [rsp + 0xb43], sil
call fcn.140078140
mov qword [0x1402281b8], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 2
lea rdx, [rsp + 0x110]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14008c2ef
mov eax, esi
jmp 0x14008c303
movzx eax, word [rsp + 0x110]
mov word [0x14026aca8], ax
mov eax, 0xffffffff
mov dword [rsp + 0x74], eax
test eax, eax
jne 0x14008c3e6
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14008c388
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14008c3a1
test rax, rax
je 0x14008c3a1
cmp rax, rbx
je 0x14008c3a1
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor r9d, r9d
lea r8, str.WinVNC
lea rdx, [0x140227de0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008c3a1
xor r9d, r9d
lea r8, str.WinVNC
lea rdx, [0x140227de0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c3d1
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c3df
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
xor eax, eax
jmp 0x14008e3c0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x14008c3f0
test rax, rax
je 0x14008c429
mov rbx, rdi
movsx ecx, byte [rbx]
call fcn.14015a9c4
mov byte [rbx], al
inc rbx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx], 0
jne 0x14008c415
mov rax, rbx
sub rax, rdi
cmp rax, rcx
jb 0x14008c401
mov dword [rsp + 0x70], esi
mov r12, rsi
mov r14d, 1
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x14008c440
cmp r12, rax
jae 0x14008e2be
lea rbx, [r12 + rdi]
cmp byte [rbx], 0x20
jle 0x14008dd0f
mov dword [rsp + 0x70], r14d
mov r8d, 8
lea rdx, str._inifile
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c569
add r12, 8
lea rcx, [rdi + 1]
add rcx, r12
mov qword [rsp + 0x40], 0x104
lea rax, [rsp + 0x930]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x104
lea rax, [rsp + 0xb50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rsp + 0xc60]
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
call fcn.140162c58
mov edx, 0x20
lea rcx, [rsp + 0x930]
call fcn.140149e60
test rax, rax
je 0x14008c4f6
mov byte [rax], 0
lea rax, [rsp + 0x930]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc60]
lea r8, [rsp + 0x4f0]
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.1401624a0
lea rcx, [rsp + 0x3e0]
call fcn.14015b020
mov qword [0x14021f178], rax
lea rcx, [rsp + 0x3e0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14008c555
add r12, rax
inc r12
jmp 0x14008c430
mov r8d, recvfrom
lea rdx, str._settingshelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c602
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rdi + 0x10]
add r8, r12
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.140150800
lea rcx, [rsp + 0x2b0]
call fcn.14001ebc0
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c5e7
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c5f5
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._stopservicehelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c676
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020c80
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c65b
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c669
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, 5
lea rdx, str._kill
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c75c
lea r8, str.GlobalSessionEventUltra
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [0x140285d60], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140285d60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.WinVNC_Tray_Icon
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
jne 0x14008c6e7
mov rbx, qword [0x14021f110]
test rbx, rbx
je 0x14008c711
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9c42
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c741
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c74f
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._openhomepage
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c7e3
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [0x1401f1258]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c7c8
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c7d6
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, 0xa
lea rdx, str._openforum
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c86a
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__forum.uvnc.com_
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c84f
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c85d
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str._opengithub
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c8f1
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__github.com_ultravnc
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c8d6
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c8e4
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._openmastodon
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c978
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__mastodon.social__ultravnc
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c95d
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c96b
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._openfacebook
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008c9ff
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__www.facebook.com_ultravnc1
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008c9e4
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008c9f2
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._openxtwitter
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008ca86
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__twitter.com_ultravnc1
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008ca6b
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008ca79
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str._openreddit
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cb0d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__www.reddit.com_r_ultravnc
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008caf2
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cb00
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str._openopenhub
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cb94
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__openhub.net_p_ultravnc
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cb79
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cb87
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str._startservicehelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cc08
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020d50
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cbed
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cbfb
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, recvfrom
lea rdx, str._installhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cc7c
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020e20
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cc61
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cc6f
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._uninstallhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008ccf0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020ef0
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008ccd5
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cce3
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._softwarecadhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cd64
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018f00
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cd49
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cd57
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._delsoftwarecadhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008ce82
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x2b0], __WSAFDIsSet
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x2b4], 6
jb 0x14008ce37
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x80], WSAStartup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
lea rax, str.runas
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x98], rax
lea rax, str._delsoftwarecad
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0xb8], rsi
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008ce67
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008ce75
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._rebootsafemodehelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cef6
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002b620
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cedb
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cee9
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._rebootforcehelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cf6a
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002b210
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cf4f
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cf5d
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._securityeditorhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008cfde
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140020fc0
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008cfc3
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008cfd1
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, recvfrom
lea rdx, str._securityeditor
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d0d9
mov r8d, 0x104
lea rdx, [rsp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14008d043
mov edx, 0x5c
lea rcx, [rsp + 0x2b0]
call fcn.140149b38
mov byte [rax], 0
lea r8, str._authSSP.dll
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.140150860
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14008d08e
lea rdx, str.vncEditSecurity
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rdx, qword [0x1402281b8]
xor ecx, ecx
call rdi
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d0be
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d0cc
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, 9
lea rdx, str._settings
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d163
lea r8, [rdi + 0xa]
add r8, r12
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.140150800
lea rcx, [rsp + 0x2b0]
call fcn.14001ece0
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d148
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d156
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._dsmpluginhelper
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d29b
lea r8, [rdi + 0x11]
add r8, r12
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.140150800
lea r8, str.__dsmplugininstance
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.140150800
lea r8, [rsp + 0x2b0]
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
call fcn.140150860
mov r8d, 0x104
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x80], WSAStartup
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x88], rax
lea rax, str.runas
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0xb0], esi
mov qword [rsp + 0xb8], rsi
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d280
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d28e
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._dsmplugininstance
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d325
lea r8, [rdi + 0x13]
add r8, r12
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call fcn.140150800
lea rcx, [rsp + 0x2b0]
call fcn.140082820
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d30a
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d318
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x1401eb8a8]
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d441
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14008d3f6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.System
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008d3eb
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d426
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d434
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, recvfrom
lea rdx, [0x1401ebc10]
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d53d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14008d4f2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.System
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008d4e7
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d522
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d530
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, recvfrom
lea rdx, [0x1401ebb50]
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d5a6
call fcn.14002b2b0
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008d58b
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008d599
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, [0x1401eb8e8]
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d5db
call fcn.14002b150
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str._stopservice
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d63b
lea r9, [0x14021bd30]
lea r8, str.net_stop___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021d20
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._startservice
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d69b
lea r9, [0x14021bd30]
lea r8, str.net_start___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021d20
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, recvfrom
lea rdx, str._installdriver
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d6d2
mov cl, 1
call fcn.140034080
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, 8
lea rdx, str._install
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d766
movzx eax, byte [rbx]
test al, al
je 0x14008d70c
movzx ecx, al
call fcn.140162830
test eax, eax
jne 0x14008d81f
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008d6f2
lea rdi, [0x14021bd30]
call fcn.14002a8b0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, rdi
lea r8, str.net_start___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021d20
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, 0xa
lea rdx, str._uninstall
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d7ef
movzx eax, byte [rbx]
test al, al
je 0x14008d7a0
movzx ecx, al
call fcn.140162830
test eax, eax
jne 0x14008d8be
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008d786
lea rdi, [0x14021bd30]
mov r9, rdi
lea r8, str.net_stop___s_
mov edx, 0x124
lea rcx, [rsp + 0x2b0]
call fcn.140021d20
xor edx, edx
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_WinExec]
call fcn.14002ad60
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str._preconnect
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d95e
add r12, 0xb
mov byte [0x14021f65a], 1
inc r12
jmp 0x14008c430
movzx eax, byte [rbx]
test al, al
je 0x14008d70c
nop word [rax + rax]
movzx ecx, al
call fcn.140162830
test eax, eax
je 0x14008d84b
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008d830
jmp 0x14008d70c
movzx eax, byte [rbx]
test al, al
je 0x14008d70c
cmp al, 0x22
jne 0x14008d866
inc rbx
cmp byte [rbx], 0
je 0x14008d70c
mov edx, 0x22
mov rcx, rbx
call fcn.140149b38
test rax, rax
je 0x14008d87b
mov byte [rax], 0
cmp byte [rbx], 0
je 0x14008d70c
lea rdi, [0x14021bd30]
mov rdx, rdi
mov rcx, rbx
call fcn.14015acf8
test eax, eax
je 0x14008d713
mov r9d, 0x100
mov r8, rbx
mov edx, r9d
mov rcx, rdi
call fcn.14015abcc
mov byte [0x14021be2f], 0
jmp 0x14008d713
movzx eax, byte [rbx]
test al, al
je 0x14008d7a0
nop dword [rax]
movzx ecx, al
call fcn.140162830
test eax, eax
je 0x14008d8eb
inc rbx
movzx eax, byte [rbx]
test al, al
jne 0x14008d8d0
jmp 0x14008d7a0
movzx eax, byte [rbx]
test al, al
je 0x14008d7a0
cmp al, 0x22
jne 0x14008d906
inc rbx
cmp byte [rbx], 0
je 0x14008d7a0
mov edx, 0x22
mov rcx, rbx
call fcn.140149b38
test rax, rax
je 0x14008d91b
mov byte [rax], 0
cmp byte [rbx], 0
je 0x14008d7a0
lea rdi, [0x14021bd30]
mov rdx, rdi
mov rcx, rbx
call fcn.14015acf8
test eax, eax
je 0x14008d7a7
mov r9d, 0x100
mov r8, rbx
mov edx, r9d
mov rcx, rdi
call fcn.14015abcc
mov byte [0x14021be2f], 0
jmp 0x14008d7a7
mov r8d, reloc.WS2_32.dll_inet_ntoa
lea rdx, str._service_run
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008d9c7
mov rcx, r15
call fcn.14008bad0
test al, al
jne 0x14008d99a
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov rax, qword [0x14022a710]
mov dword [rax + 0xe20], r14d
call fcn.14008e8b0
test eax, eax
setne cl
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str._service_rdp_run
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008da37
mov rcx, r15
call fcn.14008bad0
test al, al
jne 0x14008da03
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov rax, qword [0x14022a710]
mov dword [rax + 0xe20], r14d
mov dword [rax + 0xe24], r14d
call fcn.14008e8b0
test eax, eax
setne cl
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, 8
lea rdx, str._service
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008dab7
mov r8, rdi
mov edx, 0x100
lea rcx, [0x14021f2e0]
call fcn.140150800
lea rdi, [0x14021bd30]
mov qword [rsp + 0xf0], rdi
lea rax, [0x14002a210]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], rsi
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, 4
lea rdx, str._run
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008db12
mov rcx, r15
call fcn.14008bad0
test al, al
jne 0x14008daf3
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
call fcn.14008e8b0
test eax, eax
setne cl
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
mov r8d, 8
lea rdx, str._sc_exit
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008db45
mov rax, qword [0x14022a710]
mov byte [rax + 0xe2c], 1
add r12, 8
inc r12
jmp 0x14008c430
mov r8d, 0xa
lea rdx, str._sc_prompt
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008db78
mov rax, qword [0x14022a710]
mov byte [rax + 0xe2d], 1
add r12, 0xa
inc r12
jmp 0x14008c430
mov r8d, 6
lea rdx, str._multi
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008dba4
mov byte [0x14021f0a2], 1
add r12, 6
inc r12
jmp 0x14008c430
mov r8d, recvfrom
lea rdx, str._stopreconnect
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008dbe9
add r12, 0xe
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x14022a6ec]
call fcn.140021640
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x14022a70c]
call fcn.140021640
inc r12
jmp 0x14008c430
mov r8d, recvfrom
lea rdx, str._autoreconnect
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008dd1e
add r12, 0xe
mov byte [rsp + 0x50], 1
mov r15, rsi
mov rbx, r12
movzx eax, byte [r12 + rdi]
cmp al, 0x20
jg 0x14008dc2f
nop
test al, al
je 0x14008dc2f
inc rbx
movzx eax, byte [rbx + rdi]
cmp al, 0x20
jle 0x14008dc20
lea r13, [rbx + rdi]
mov r8d, 3
lea rdx, [0x1401eb82c]
mov rcx, r13
call fcn.14015a010
test eax, eax
jne 0x14008dc95
mov r12, rbx
cmp byte [r13], 0x20
jle 0x14008dc60
inc r12
cmp byte [r12 + rdi], 0x20
jg 0x14008dc56
mov r14, r12
sub r14, rbx
je 0x14008dc95
lea rcx, [r14 + 1]
call fcn.140147b5c
mov rbx, rax
mov r9, r14
mov r8, r13
lea rdx, [r14 + 1]
mov rcx, rax
call fcn.14015abcc
mov byte [rbx + r14], r15b
mov rcx, rbx
call fcn.14015b780
mov r15, rax
movzx eax, si
test r15, r15
je 0x14008dca6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx r8d, ax
xor edx, edx
mov ecx, dword [0x14022a6f4]
call fcn.140021640
test eax, eax
jne 0x14008dd17
mov byte [0x140227bc1], 1
test r15, r15
jne 0x14008dce8
mov byte [0x140227faa], 1
mov byte [0x140227bc1], r15b
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
mov r8, r15
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [0x1402283c8]
call fcn.140150800
mov rcx, r15
call fcn.140147b10
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
test r15, r15
je 0x14008dd04
jmp 0x14008dcfc
mov r8d, 4
lea rdx, str._id:
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008dded
inc r12
mov r15, rsi
mov rbx, r12
lea r13, [r12 + rdi]
cmp byte [r13], 0x20
jle 0x14008dd59
nop
inc rbx
cmp byte [rbx + rdi], 0x20
jg 0x14008dd50
mov r14, rbx
sub r14, r12
je 0x14008dd8f
lea rcx, [r14 + 1]
call fcn.140147b5c
mov r15, rax
mov r9, r14
mov r8, r13
lea rdx, [r14 + 1]
mov rcx, rax
call fcn.14015abcc
mov byte [r14 + r15], 0
mov rcx, r15
call fcn.14015b780
mov r15, rax
mov r12, rbx
movzx eax, si
test r15, r15
je 0x14008dda3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx r8d, ax
xor edx, edx
mov ecx, dword [0x14022a700]
call fcn.140021640
test eax, eax
jne 0x14008dd17
mov byte [0x1402283dc], 1
test r15, r15
jne 0x14008dce8
mov byte [0x140227fab], 1
mov byte [0x1402283dc], r15b
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
mov r8d, 8
lea rdx, str._connect
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008e10f
test r13b, r13b
jne 0x14008de1f
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x14022a6ec]
call fcn.140021640
add r12, 8
mov rbx, r12
movzx eax, byte [r12 + rdi]
cmp al, 0x20
jg 0x14008de3f
nop
test al, al
je 0x14008de3f
inc rbx
movzx eax, byte [rbx + rdi]
cmp al, 0x20
jle 0x14008de30
mov r13, rbx
lea rax, [rbx + rdi]
cmp byte [rax], 0x20
jle 0x14008de5a
nop dword [rax + rax]
inc r13
cmp byte [rdi + r13], 0x20
jg 0x14008de50
mov r15, r13
sub r15, rbx
je 0x14008e0a7
lea r12, [r15 + 1]
mov rcx, r12
call fcn.140147b5c
mov r14, rax
mov rcx, r12
call fcn.140147b5c
mov qword [rsp + 0x68], rax
mov r9, r15
lea r8, [rbx + rdi]
mov rdx, r12
mov rcx, r14
call fcn.14015abcc
mov rax, r14
sub rax, rbx
mov byte [rax + r13], 0
mov r8, r14
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call fcn.140150800
mov edx, 0x5b
mov rcx, r14
call fcn.140149e60
mov r15, rax
mov edx, 0x5d
mov rcx, r14
call fcn.140149e60
mov rbx, rax
test r15, r15
je 0x14008df0f
test rax, rax
je 0x14008df0f
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x14008dee0
lea r8, [rax + 1]
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call fcn.14015abcc
mov byte [rbx], 0
lea r8, [r15 + 1]
mov rdx, r12
mov rcx, r14
call fcn.140150800
jmp 0x14008df24
mov edx, 0x3a
mov rcx, r14
call fcn.140149e60
test rax, rax
je 0x14008df24
mov byte [rax], 0
mov edx, 0x3a
mov r15d, 0x157c
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.140149e60
test rax, rax
je 0x14008df5a
mov byte [rax], 0
cmp byte [rax + 1], 0x3a
lea rcx, [rax + 2]
je 0x14008df52
lea rcx, [rax + 1]
call fcn.14015a3b0
mov r15d, eax
mov rcx, rbx
call fcn.140147b10
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, str.WinMain_:_test...__s__d_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov r8, r14
mov edx, 0xff
lea rcx, [0x1402280b0]
call fcn.140150800
mov rcx, r14
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
mov eax, 0xffffffff
cmp ebx, eax
jne 0x14008dfcb
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14008e06a
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
test rcx, rcx
je 0x14008e06a
mov ebx, dword [rcx]
mov rcx, r14
call fcn.140147b10
test ebx, ebx
je 0x14008e072
lea r8, str.WinMain_:_PostAddNewClient_III__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
movzx r14d, r15w
mov r8d, ebx
mov edx, r14d
mov ecx, dword [0x14022a6f0]
call fcn.140021640
test eax, eax
jne 0x14008e054
lea r8, str.postHelper::PostAddNewClientInit_:_PostAddNewClient_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov edx, 0x457
cmp r14w, dx
jne 0x14008e040
movzx eax, byte [0x14021f0a1]
cmp ebx, edx
mov ecx, 1
cmove eax, ecx
mov byte [0x14021f0a1], al
mov byte [0x140227bc2], 1
mov dword [0x140227bc4], r15d
mov dword [0x140227fac], ebx
mov r12, r13
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
mov rcx, r14
call fcn.140147b10
mov byte [0x140227bc2], 1
mov dword [0x140227bc4], esi
mov dword [0x140227fac], esi
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14008be70
movzx ebx, al
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
jmp 0x14008e3c0
lea r8, str.WinMain_:_PostAddNewClient_IIII_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
xor r8d, r8d
xor edx, edx
mov ecx, dword [0x14022a6fc]
call fcn.140021640
test eax, eax
jne 0x14008dd04
lea r8, str.postHelper::PostAddNewClient_:_PostAddNewClient_failed_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov byte [0x140227bc2], 1
mov dword [0x140227bc4], esi
mov dword [0x140227fac], esi
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
mov r8d, 9
lea rdx, str._repeater
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x14008e212
add r12, 9
mov rcx, r12
movzx eax, byte [r12 + rdi]
cmp al, 0x20
jg 0x14008e14f
nop dword [rax]
test al, al
je 0x14008e14f
inc rcx
movzx eax, byte [rcx + rdi]
cmp al, 0x20
jle 0x14008e140
mov rbx, rcx
lea r13, [rcx + rdi]
cmp byte [r13], 0x20
jle 0x14008e169
nop dword [rax]
inc rbx
cmp byte [rbx + rdi], 0x20
jg 0x14008e160
mov r14, rbx
sub r14, rcx
je 0x14008dd09
mov rcx, qword [0x140227dd8]
test rcx, rcx
je 0x14008e18d
call fcn.140147b10
mov qword [0x140227dd8], rsi
lea rcx, [r14 + 1]
call fcn.140147b5c
mov qword [0x140227dd8], rax
mov r9, r14
mov r8, r13
lea rdx, [r14 + 1]
mov rcx, rax
call fcn.14015abcc
mov rax, qword [0x140227dd8]
mov byte [rax + r14], 0
lea r8, str.WinMain_:_PostAddNewRepeaterClient_I_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018d00
mov eax, 0xffffffff
mov r8d, eax
mov edx, eax
mov ecx, dword [0x14022a6fc]
call fcn.140021640
test eax, eax
jne 0x14008e1fc
mov byte [0x140227bc3], 1
mov dword [0x140227bc4], esi
mov dword [0x140227fac], esi
mov r12, rbx
mov r15, qword [rsp + 0x60]
movzx r13d, byte [rsp + 0x50]
inc r12
jmp 0x14008c430
mov rax, qword [0x14022a710]
cmp dword [rax + 0xe20], 0
je 0x14008e29d
xor edx, edx
xor ecx, ecx
mov r8d, 0x400001cf
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rbx, rbx
je 0x14008e374
test rax, rax
je 0x14008e374
cmp rax, rbx
je 0x14008e374
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov r9d, 0x40
lea r8, [0x140229170]
lea rdx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x14008e374
mov r9d, 0x40
lea r8, [0x140229170]
lea rdx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14008e374
cmp dword [rsp + 0x70], 0
jne 0x14008e374
mov rcx, r15
call fcn.14008bad0
test al, al
jne 0x14008e320
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008e305
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008e313
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14008e3c0
call fcn.14008e8b0
mov ebx, eax
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008e357
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008e364
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
test ebx, ebx
setne sil
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
jmp 0x14008e3c0
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rax, qword [0x14021f2c8]
test rax, rax
jne 0x14008e3ab
mov ecx, 0x1134
call fcn.140147b18
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.140027870
nop
mov qword [0x14021f2c8], rax
test rax, rax
je 0x14008e3b8
mov edx, 0x1134
mov rcx, rax
call fcn.140147b54
xor eax, eax
jmp 0x14008e3c0
mov rcx, qword [rsp + 0xd70]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0xd80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret