Function at 0x41e8f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
mov dword [esi + 0xe10c], edi
cmp dword [ebp + 8], edi
jne 0x41e946
cmp ebx, edi
jne 0x41e946
mov ecx, dword [esi + 0xdbd0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xb8]
call edx
test eax, eax
jne 0x41e946
mov ecx, dword [esi + 0xdbd0]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
push 1
mov dword [ebp + 8], 1
call edx
push str.._vncdesktop.cpp_:_SethookMechanism_called_r_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [0x48b140]
add esp, 4
cmp eax, 4
je 0x41eaeb
cmp eax, 5
je 0x41eaeb
mov edx, 1
cmp eax, edx
je 0x41e9cf
cmp eax, 2
je 0x41e9cf
cmp dword [ebp + 8], edi
jne 0x41e98c
mov dword [esi + 0xe104], edi
jmp 0x41e992
mov dword [esi + 0xe104], edx
mov eax, dword [esi + 0xe108]
xor ecx, ecx
cmp dword [esi + 0xe104], edi
mov dword [esi + 0xa0], edi
setne cl
xor edx, edx
cmp eax, ecx
setne dl
mov dword [esi + 0xe108], ecx
mov dword [esi + 0xe110], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0045dc1f
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], edi
jne 0x41e9e6
mov dword [esi + 0xe104], edi
cmp ebx, edi
jne 0x41e9f0
mov dword [esi + 0xa0], edi
jmp 0x41e9f6
cmp ebx, edi
je 0x41ea1b
mov dword [esi + 0xe104], edi
mov dword [esi + 0xa0], edx
mov ecx, dword [esi + 0xe104]
mov eax, dword [esi + 0xe108]
xor ebx, ebx
cmp ecx, edi
setne bl
mov dword [esi + 0xe108], ebx
cmp eax, ebx
je 0x41ea29
mov dword [esi + 0xe110], edx
jmp 0x41ea2f
mov dword [esi + 0xe104], edx
mov dword [esi + 0xa0], edi
jmp 0x41e9f6
mov dword [esi + 0xe110], edi
cmp dword [0x48b140], 2
jne 0x41ea3e
mov dword [esi + 0xe110], edx
mov eax, dword [esi + 0xa0]
push eax
push ecx
push str.._vncdesktop.cpp_:_Sethook_restart_wanted_hook_d_driver_d__r_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 0xc
cmp dword [esi + 0xe110], edi
je 0x41ea76
push str.._vncdesktop.cpp_:_Hookdll_status_changed__r_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
mov ecx, dword [esi + 0xa0]
cmp ecx, edi
je 0x41eaaa
mov eax, dword [esi + 0xe0d8]
cmp eax, edi
je 0x41eab9
cmp dword [eax + 8], edi
jne 0x41eaa2
mov eax, 1
mov dword [esi + 0xe10c], eax
mov dword [esi + 0xe110], eax
jmp 0x41eabe
cmp ecx, edi
jne 0x41eb6b
mov ecx, esi
call fcn.0041e5f0
test eax, eax
je 0x41eb6b
mov eax, 1
mov dword [esi + 0xe10c], eax
push str.._vncdesktop.cpp_:_Driver_Status_changed_r_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0045dc1f
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0xa0], edi
mov dword [esi + 0xe104], edi
cmp dword [ebp + 8], edi
jne 0x41eb00
cmp ebx, edi
je 0x41eb0a
mov dword [esi + 0xe104], 1
mov eax, dword [esi + 0xe118]
cmp eax, edi
je 0x41eb28
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0xe118], edi
mov dword [esi + 0xe0f8], edi
mov dword [esi + 0xe0f8], edi
cmp ebx, edi
je 0x41eb39
push 1
call fcn.0041eb80
mov eax, dword [esi + 0xe108]
cmp ebx, edi
jne 0x41eb50
cmp dword [ebp + 8], edi
jne 0x41eb50
mov dword [esi + 0xe108], edi
jmp 0x41eb5a
mov dword [esi + 0xe108], 1
xor ecx, ecx
cmp eax, dword [esi + 0xe108]
setne cl
mov dword [esi + 0xe110], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045dc1f
mov esp, ebp
pop ebp
ret 4