Function at 0x140053b30
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check os version
Create thread
Power down monitor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov rax, qword [0x1401fdf60]
mov ecx, dword [rax + 0xe60]
cmp ecx, 1
jne 0x140053c59
mov rax, qword [0x1401fb428]
test rax, rax
jne 0x140053baa
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x140053c4f
test rax, rax
jne 0x140053bde
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
jmp 0x140053be1
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x140053c4f
test rcx, rcx
jne 0x140053c10
mov ecx, gethostbyname
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
jmp 0x140053c13
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x140053c4f
test rcx, rcx
jne 0x140053c3f
mov ecx, gethostbyname
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
mov rcx, rax
mov qword [0x1401fb428], rax
cmp byte [rcx + 8], 0
jne 0x140053c4f
mov al, 1
mov byte [0x1401f2900], al
jmp 0x140053c63
xor al, al
mov byte [0x1401f2900], al
jmp 0x140053c63
cmp ecx, 2
sete byte [0x1401f2900]
mov byte [rdi + 0x10b78], 1
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_1_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xeac8], rax
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_2_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov dword [rbp + 0x110], __WSAFDIsSet
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140053d8e
lea r8, str.vncDesktop::KillScreenSaver_:_KillScreenSaver..._n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov eax, dword [rbp + 0x120]
sub eax, 1
je 0x140053d67
cmp eax, 1
jne 0x140053d8e
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
lea rcx, str.Screen_saver
call qword [sym.imp.USER32.dll_OpenDesktopA]
mov rbx, rax
test rax, rax
je 0x140053d8e
lea r8, str.vncDesktop::KillScreenSaver_:_Killing_ScreenSaver_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor r8d, r8d
lea rdx, [0x14004cb50]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 - 1]
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x140053d8e
xor edx, edx
lea rcx, str.WindowsScreenSaverClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140053d8e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
xor r8d, r8d
xor edx, edx
mov cl, select
call fcn.14002f680
xor edx, edx
lea r8d, [rdx + 2]
mov cl, select
call fcn.14002f680
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x10a90]
call fcn.14004c320
mov ebx, eax
test eax, eax
je 0x140053e00
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xeac8]
call fcn.140020bb0
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xeac0]
test rcx, rcx
je 0x140053df0
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x20]
jmp 0x140056099
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x20]
mov rax, qword [0x1401fdf60]
mov r8d, dword [rax + 0xe50]
mov edx, dword [rax + 0xe54]
mov rcx, qword [rdi + 0x10a90]
call fcn.14004f540
mov byte [rdi + 0x10b79], 0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov qword [rbp - 0x60], r14
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp - 0x50], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x58], rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp - 0x40], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x48], rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp - 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x38], rax
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x20], r12b
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
lea r13, vtable.rfb::ClippedUpdateTracker.0
mov qword [rbp - 0x10], r13
lea rax, [rbp - 0x60]
mov qword [rbp - 8], rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp], rax
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov byte [rbp - 0x20], 1
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rsp + 0x40], rax
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rdi + 0x10a90]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xe8]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbp + 0xc8]
mov qword [rdi + 0x10a9c], rax
mov rdx, qword [rdi + 0x10a90]
mov rax, qword [rdx + 0xe458]
test rax, rax
je 0x14005409e
cmp qword [rax + 0x20], r12
je 0x14005408a
cmp dword [rdx + 0x8d0], r12d
je 0x14005409e
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xe0]
mov rax, qword [rdi + 0x10a90]
mov qword [rax + 0x808], 4
jmp 0x14005409e
mov dword [rdx + 0xe9ec], 1
mov dword [rdx + 0xe9f0], 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f0], 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe978], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9ec], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f4], r12d
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f8], r12d
mov ebx, r12d
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
jne 0x14005413b
nop
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jg 0x14005413b
lea r8, str.vncDesktopThread::run_undetached_:_Wait_for_viewer_init__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
je 0x140054100
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10b00], dl
test eax, eax
jne 0x140054181
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054181
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx edx, byte [rdi + 0x10b00]
test dl, dl
je 0x1400541b9
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400541a9
mov rax, qword [rcx]
call qword [rax + 0x20]
movzx edx, byte [rdi + 0x10b00]
test dl, dl
je 0x1400541b9
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b08], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b0c], eax
mov r15d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
mov byte [0x1401f2eb8], r15b
mov byte [rdi + 0x10a98], 1
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
cmp byte [0x1401f2eba], r12b
jne 0x1400543d5
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054351
cmp qword [rcx + 0x20], r15
je 0x140054337
cmp dword [rax + 0x8d0], r12d
je 0x140054351
mov rax, qword [0x1401fb428]
test rax, rax
jne 0x1400542d8
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x140054358
test rax, rax
jne 0x140054309
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
mov esi, 1
cmp byte [rcx + 8], 0
jne 0x14005435d
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
mov r9d, esi
mov r8d, esi
lea rdx, [rsp + 0x40]
call fcn.140035960
jmp 0x1400543da
mov esi, 1
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fb428]
jmp 0x14005435d
mov rax, qword [0x1401fb428]
mov esi, 1
test rax, rax
jne 0x14005437f
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x1400543da
test rax, rax
jne 0x1400543ac
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
jmp 0x1400543af
mov rax, rcx
cmp byte [rax + 8], 0
jne 0x1400543da
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
mov r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140035960
jmp 0x1400543da
mov esi, 1
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe4cc], esi
mov qword [rbp + 0x28], r12
mov qword [rbp - 0x68], r12
mov rax, qword [0x1401fdf60]
cmp dword [rax + 0xa58], 0
mov ecx, 0x80000043
jne 0x140054409
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x14005450e
cmp qword [rcx + 0x20], 0
je 0x140054502
cmp dword [rax + 0x8d0], 0
je 0x14005450e
mov rax, qword [0x1401fb428]
test rax, rax
jne 0x140054467
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x140054515
test rax, rax
jne 0x14005449c
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
cmp byte [rcx + 8], 0
jne 0x140054515
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053a40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0xb4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053ac0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
jmp 0x140054634
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fb428]
mov rcx, qword [rdi + 0x10a90]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140054780
cmp qword [rdx + 0x20], 0
je 0x140054774
cmp dword [rcx + 0x8d0], 0
je 0x140054780
test rax, rax
jne 0x140054566
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x1400545a0
test rax, rax
jne 0x140054593
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
jmp 0x140054596
mov rax, rcx
cmp byte [rax + 8], 0
je 0x140054780
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xe3e8], rax
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 0x10a90]
mov qword [rcx + 0xe3f0], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
cmp byte [rdi + 0x10b00], 0
je 0x140054634
mov rax, qword [rdi + 0x10a90]
cmp qword [rax + 0xe458], 0
je 0x140054630
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053ac0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, dword [rsp + 0x50]
cmp byte [rdi + 0x10a98], 0
je 0x140055e59
mov r14d, 0x421
nop word [rax + rax]
cmp byte [0x1401f32c3], 0
jne 0x140055e4b
mov rdx, qword [rdi + 0x10a90]
add rdx, 0xe3b8
mov r9d, eax
xor r8d, r8d
lea ecx, [r8 + 8]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, qword [rdi + 0x10a90]
mov edx, 0x2710
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400546a4
mov byte [rdi + 0x10a98], 0
cmp ebx, 5
ja 0x140054868
je 0x140054848
test ebx, ebx
je 0x140054917
sub ebx, 1
je 0x1400547d0
sub ebx, 1
je 0x1400547b7
sub ebx, 1
je 0x1400548a7
cmp ebx, 1
jne 0x140055e34
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], bl
mov rbx, qword [rdi + 0x10a90]
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 0
jmp 0x140055e34
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
lea rax, [rbp + 0xbc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140053ac0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x21
mov dword [rsp + 0x50], eax
jmp 0x140054634
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055e34
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 1
mov r8, qword [rdi + 0x10a90]
mov r9d, 2
mov r8, qword [r8 + 0xe418]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, qword [rdi + 0x10a90]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xe418]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a90]
mov byte [rax + 0xe428], 0
jmp 0x140055e34
mov byte [rdi + 0x10a98], 0
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055e34
cmp ebx, 6
je 0x1400548eb
cmp ebx, 7
je 0x140054893
cmp ebx, 0x102
je 0x140054917
cmp ebx, 0xffffffff
jne 0x140055e34
mov byte [rdi + 0x10a98], 0
jmp 0x140055e34
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10af8]
test rax, rax
je 0x1400548d2
mov dword [rbp - 0x80], 0x18
lea rcx, [rbp - 0x80]
call rax
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rbp - 0x78]
mov qword [rcx + 0xe960], rax
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140055e34
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r8, str.ddengine
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x1401f32c8]
call fcn.14014a500
mov rcx, qword [rdi + 0x10a90]
mov rcx, qword [rcx + 0xe3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401fdf60]
cmp dword [rax + 0xe48], 0x64
je 0x1400549ab
cmp r15d, 0xa
ja 0x1400549b5
bt r14d, r15d
jae 0x1400549b5
lea rcx, [rdi + 0x10b18]
call fcn.140018220
mov word [rdi + 0x10b68], ax
mov r8d, dword [rdi + 0x10b6c]
movsx ecx, ax
mov rax, qword [0x1401fdf60]
cmp ecx, dword [rax + 0xe48]
lea eax, [r8 + 0xa]
jg 0x14005497b
lea eax, [r8 - 0xa]
lea r8, [rdi + 0x10b6c]
mov ecx, eax
mov dword [r8], eax
mov ecx, dword [rdi + 0x10b74]
cmp eax, ecx
jae 0x140054999
mov dword [rdi + 0x10b6c], ecx
mov eax, ecx
mov ecx, dword [rdi + 0x10b70]
cmp eax, ecx
jbe 0x1400549b5
mov dword [rdi + 0x10b6c], ecx
jmp 0x1400549b5
mov dword [rdi + 0x10b6c], 0x19
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10b04], eax
mov ecx, dword [rdi + 0x10b08]
mov r8d, dword [rdi + 0x10b6c]
mov edx, eax
sub edx, ecx
cmp edx, r8d
jae 0x1400549e2
sub ecx, eax
add ecx, r8d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054a25
cmp qword [rcx + 0x20], 0
je 0x140054a19
cmp dword [rax + 0x8d0], 0
je 0x140054a25
mov rax, qword [rdi]
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x140054a25
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [rdi + 0x10a90]
cmp dword [rax + 0xe9f0], 0
je 0x140054a9b
cmp dword [rax + 0xe9ec], 0
jne 0x140054a9b
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10a90]
movsxd r8, dword [rcx + 0xe9e8]
xor r9d, r9d
mov edx, 0x8007
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [rdi + 0x10a90]
cmp dword [rax + 0xe9e8], 0
je 0x140054a94
mov qword [rax + 0xe968], r12
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe9f0], r12d
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x250]
test al, al
jne 0x140054add
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140052800
test al, al
jne 0x140054add
mov byte [rdi + 0x10a98], al
jmp 0x140055e34
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x238]
mov rcx, qword [rdi + 0x10a90]
mov byte [rcx + 0x8d4], al
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x240]
mov rcx, qword [rdi + 0x10a90]
mov byte [rcx + 0x8d5], al
mov rax, qword [rdi + 0x10a90]
add rax, 0xe4e8
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x113
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
jne 0x140054b79
cmp byte [rdi + 0x10b79], al
jne 0x140055e29
mov eax, dword [rdi + 0x10b04]
mov dword [rdi + 0x10b08], eax
xor r14b, r14b
mov byte [rsp + 0x30], r14b
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140054c0c
mov rax, qword [rbp + 0x50]
cmp eax, dword [rdi + 0x10a9c]
jne 0x140054bb2
mov ecx, dword [rdi + 0x10aa0]
cmp dword [rbp + 0x54], ecx
je 0x140054c0c
mov r14b, 1
mov byte [rsp + 0x30], r14b
mov qword [rdi + 0x10a9c], rax
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rax, qword [rdi + 0x10af8]
test rax, rax
je 0x140054c0c
mov dword [rbp + 0xf8], 0x18
lea rcx, [rbp + 0xf8]
call rax
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rbp + 0x100]
mov qword [rcx + 0xe960], rax
xor r13b, r13b
mov r8, qword [rdi + 0x10a90]
cmp dword [r8 + 0x8d0], 0
jne 0x140054c41
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.14004eaa0
movzx r13d, al
mov r8, qword [rdi + 0x10a90]
cmp dword [r8 + 0x8d0], 0
je 0x140054ca7
cmp byte [r8 + 0xea78], 0
je 0x140054ca7
cmp dword [r8 + 0xea68], 0
jne 0x140054ca7
mov rax, qword [0x1401fdf60]
test r14b, r14b
je 0x140054c80
mov ecx, r12d
cmp dword [rax + 0xe30], 0
setne cl
inc ecx
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140054cd9
mov ecx, 2
cmp dword [rax + 0xe30], 0
mov eax, 4
cmovne ecx, eax
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140054dfa
test r13b, r13b
jne 0x140054cd0
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140053640
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
test r14b, r14b
je 0x140054dfa
mov rcx, qword [rdi + 0x10a90]
cmp dword [rcx + 0x8d0], 0
jne 0x140054dfa
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x140054dfa
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x140054dfa
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140054d58
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140054d66
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x140054d7b
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x140054d8f
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x140054df7
test edx, edx
jle 0x140054df7
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019526c]
call fcn.140149d90
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140137f30
movzx r14d, byte [rsp + 0x30]
mov esi, 1
xor r12d, r12d
mov rax, qword [rdi + 0x10a90]
add rax, 0xe4e8
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], 0x114
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x1401fdf60]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b68]
cmp ecx, eax
jge 0x140054e64
mov rcx, qword [rdi + 0x10a90]
cmp dword [rcx + 0x8d0], 0
jne 0x140054e64
test r13b, r13b
jne 0x140054e64
lea rdx, [rbp - 0x10]
call fcn.14004eaa0
movzx eax, byte [0x1401f2eba]
test al, al
je 0x140054eb8
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x248]
test al, al
je 0x140054ead
mov rcx, qword [rdi + 0x10a90]
mov r8d, dword [rcx + 0x838]
mov rdx, qword [rcx + 0x870]
mov rcx, qword [rcx + 0x878]
call fcn.14004d8b0
jmp 0x140054f13
movzx eax, byte [0x1401f2eba]
test al, al
jne 0x140054f13
mov rcx, qword [rdi + 0x10a90]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140054ef3
cmp qword [rdx + 0x20], 0
je 0x140054ee0
cmp dword [rcx + 0x8d0], 0
je 0x140054ef3
mov r8d, esi
jmp 0x140054efa
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
mov rcx, qword [rdi + 0x10a90]
test al, al
jne 0x140054f13
xor r8d, r8d
movzx r9d, byte [rdi + 0x10b78]
lea rdx, [rsp + 0x40]
add rcx, 0x7e8
call fcn.140035960
mov byte [rdi + 0x10b78], 1
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov ecx, r12d
cmp byte [rdi + 0x10b00], 0
sete cl
cmp ecx, eax
jne 0x140054f86
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10b00], dl
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054f86
mov rax, qword [rcx]
test dl, dl
jne 0x140054f83
call qword [rax + 0x18]
jmp 0x140054f86
call qword [rax + 0x20]
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov rcx, qword [rdi + 0x10a90]
test eax, eax
je 0x140055195
mov rax, qword [rcx + 0xe968]
cmp qword [rcx + 0xe960], rax
jne 0x140054fd1
mov eax, dword [rcx + 0x880]
mov dword [rcx + 0x880], r12d
test eax, eax
je 0x14005533a
mov rcx, qword [rdi + 0x10a90]
mov rax, qword [rcx + 0xe960]
mov qword [rcx + 0xe968], rax
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0x810], esi
mov rsi, qword [rdi + 0x10a90]
cmp dword [rsi + 0x8d0], 0
je 0x14005500c
cmp byte [rsi + 0xea78], 0
jne 0x140055075
add rsi, 0x7e8
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x14005502f
cmp qword [rsi + 0x88], rcx
jne 0x140055038
cmp qword [rsi + 0x88], rcx
je 0x140055044
mov rcx, rsi
call fcn.140034d90
test eax, eax
je 0x140055075
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004e4d0
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140035ef0
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a90]
mov r11d, dword [rcx + 0xe42c]
mov r8d, dword [rcx + 0xe434]
sub r8d, r11d
mov r15d, dword [rcx + 0xe430]
mov edx, dword [rcx + 0xe438]
sub edx, r15d
mov r10d, dword [rcx + 0xe514]
mov esi, dword [rcx + 0xe51c]
add esi, r10d
mov r9d, dword [rcx + 0xe510]
mov ebx, dword [rcx + 0xe518]
add ebx, r9d
cmp r11d, r9d
jge 0x1400550e2
mov eax, r11d
sub eax, r9d
add r8d, eax
mov r12d, r9d
cmp r11d, r9d
cmovge r12d, r11d
cmp r15d, r10d
jge 0x1400550fa
sub r15d, r10d
add edx, r15d
mov r15d, r10d
lea ecx, [rbx + r9]
lea eax, [r8 + r12]
cmp eax, ecx
jle 0x14005510f
mov r8d, ebx
sub r8d, r12d
add r8d, r9d
lea ecx, [rdx + r15]
lea eax, [r10 + rsi]
cmp ecx, eax
jle 0x140055123
mov edx, r10d
sub edx, r15d
add edx, esi
test r8d, r8d
jle 0x140055180
test edx, edx
jle 0x140055180
lea esi, [r8 + r12]
lea ebx, [rdx + r15]
lea rcx, [0x14019526c]
call fcn.140149d90
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140137f30
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
jmp 0x14005533a
cmp dword [rcx + 0x8d0], 0
je 0x1400551ab
cmp byte [rcx + 0xea78], 0
jne 0x14005533a
lea rsi, [rcx + 0x7e8]
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x1400551ce
cmp qword [rsi + 0x88], rcx
jne 0x1400551d7
cmp qword [rsi + 0x88], rcx
je 0x1400551e3
mov rcx, rsi
call fcn.140034d90
test eax, eax
je 0x140055214
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004e4d0
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140035ef0
test r14b, r14b
je 0x14005533a
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a90]
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x14005533a
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x14005533a
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x1400552a6
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x1400552b4
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x1400552c9
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x1400552dd
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x14005533a
test edx, edx
jle 0x14005533a
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019526c]
call fcn.140149d90
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140137f30
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r15, rax
mov qword [rbp + 0xa0], rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 0x98], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r12, rax
mov qword [rbp + 0x90], rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 0x88], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r13, rax
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
xor r14d, r14d
cmp eax, 1
je 0x140055468
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140026b80
mov rbx, qword [rbp + 0x128]
cmp rbx, qword [rbp + 0x130]
je 0x14005545c
mov rcx, qword [rdi + 0x10a90]
add rcx, 0x7e8
lea r8, [rbp + 0x140]
mov rdx, rbx
call fcn.1400367a0
add rbx, 0x10
cmp rbx, qword [rbp + 0x130]
jne 0x140055432
lea rcx, [rbp + 0x110]
call fcn.140045e80
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 4
mov r8, qword [rbp - 0x38]
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400558a5
mov rax, qword [0x1401fdf60]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b68]
cmp ecx, eax
jge 0x1400558a5
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140026b80
mov r13, qword [rbp + 0x128]
cmp r13, qword [rbp + 0x130]
je 0x140055890
add r13, 0xc
nop
mov r12d, dword [r13 - 4]
add r12d, 4
mov dword [rsp + 0x68], r12d
mov r8d, dword [r13]
add r8d, 4
mov dword [rsp + 0x6c], r8d
mov ecx, dword [r13 - 0xc]
add ecx, 0xfffffffc
mov dword [rsp + 0x60], ecx
mov r9d, dword [r13 - 8]
add r9d, 0xfffffffc
mov dword [rsp + 0x64], r9d
mov rdx, qword [rdi + 0x10a90]
cmp qword [rdx + 0xe458], 0
je 0x140055638
add rdx, 0x8d8
lea rax, [rsp + 0x60]
cmp ecx, dword [rdx]
cmovl rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x60], eax
lea rax, [rdx + 4]
lea rcx, [rsp + 0x64]
cmp r9d, dword [rax]
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x64], eax
lea rax, [rdx + 8]
lea rcx, [rsp + 0x68]
cmp dword [rax], r12d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x68], eax
lea rax, [rdx + 0xc]
lea rcx, [rsp + 0x6c]
cmp dword [rax], r8d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x6c], eax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r12d, dword [rsp + 0x68]
lea rcx, [0x14019526c]
call fcn.140149d90
mov r15, rax
mov r9d, dword [rsp + 0x6c]
mov r8d, r12d
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call fcn.140137f30
mov ecx, dword [rbp + 0x144]
neg ecx
mov eax, dword [rbp + 0x140]
neg eax
mov r10d, dword [rsp + 0x6c]
add r10d, ecx
lea r9d, [rax + r12]
mov dword [rbp + 0x20], r9d
mov dword [rbp + 0x24], r10d
mov edx, dword [rsp + 0x64]
add edx, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x14], edx
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x18], rax
mov r8, qword [rdi + 0x10a90]
add r8, 0x8d8
lea rax, [rbp + 0x10]
cmp ecx, dword [r8]
cmovl rax, r8
mov r15d, dword [rax]
mov dword [rbp + 0x70], r15d
lea rax, [r8 + 4]
lea rcx, [rbp + 0x14]
cmp edx, dword [rax]
cmovl rcx, rax
mov r14d, dword [rcx]
mov dword [rbp + 0x74], r14d
lea rax, [r8 + 8]
lea rcx, [rbp + 0x18]
cmp dword [rax], r9d
cmovl rcx, rax
mov esi, dword [rcx]
mov dword [rbp + 0x78], esi
lea rax, [r8 + 0xc]
lea r9, [rbp + 0x1c]
cmp dword [rax], r10d
cmovl r9, rax
mov ebx, dword [r9]
mov dword [rbp + 0x7c], ebx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x14019526c]
call fcn.140149d90
mov r12, rax
mov r9d, ebx
mov r8d, esi
mov edx, r14d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call fcn.140137f30
add r13, 0x10
lea rax, [r13 - 0xc]
cmp rax, qword [rbp + 0x130]
jne 0x140055590
mov r15, qword [rbp + 0xa0]
mov r12, qword [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.140045e80
mov r13, qword [rbp + 0x80]
jmp 0x1400558d5
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov rdx, qword [rbp - 0x38]
mov r8, rdx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055ac3
mov rbx, qword [rdi + 0x10a90]
mov rcx, qword [rbx + 0xe458]
test rcx, rcx
je 0x14005590e
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rdi + 0x10a90]
xor r14b, r14b
mov rsi, rbx
cmp byte [rbx + 0x8d5], r14b
je 0x140055998
inc dword [rdi + 0xa8]
cmp dword [rdi + 0xa8], 0xa
jle 0x140055998
mov dword [rdi + 0xa8], 0
lea rcx, [0x14019526c]
call fcn.140149d90
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rdx, r15
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140137f30
mov r14b, 1
mov rsi, qword [rdi + 0x10a90]
mov rax, qword [rsi + 0x878]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x1400559b4
cmp qword [rsi + 0x870], rcx
jne 0x1400559bd
cmp qword [rsi + 0x870], rcx
je 0x1400559d1
lea rcx, [rsi + 0x7e8]
call fcn.140034d90
test eax, eax
je 0x140055aaa
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0
mov r9b, 1
movzx r8d, r9b
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.1400255d0
mov rbx, qword [rbp - 0x80]
cmp rbx, qword [rbp - 0x78]
jne 0x140055a40
test rbx, rbx
je 0x140055aaa
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140055a3b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560cb
mov rcx, rbx
jmp 0x140055aa5
mov byte [rsp + 0x20], r14b
mov r9, rbx
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x7e8]
call fcn.140035150
add rbx, 0x10
cmp rbx, qword [rbp - 0x78]
jne 0x140055a40
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140055aaa
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055aa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560cb
call fcn.140131344
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055ac3
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rsi, qword [rdi + 0x10aa8]
mov rax, qword [rsi + 0x130]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140055b0d
nop dword [rax]
mov rax, qword [rsi]
movzx edx, word [rbx + 0x10]
mov rcx, rsi
call qword [rax + 0x90]
mov byte [rax + 0x3ac], 1
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsi + 0x130]
jne 0x140055ae0
mov rsi, qword [rdi + 0x10aa8]
cmp byte [rdi + 0x10b79], 0
jne 0x140055b45
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
call qword [rax + 0xf0]
mov byte [rdi + 0x10b79], 1
mov rcx, qword [rdi + 0x10a90]
mov eax, Ordinal_102
cmp dword [rcx], eax
mov esi, 1
cmove eax, esi
mov dword [rcx], eax
jmp 0x140055b4a
mov esi, 1
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 0x38], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x30], rax
mov r9d, 5
mov r8, r12
mov rdx, r12
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x30]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x38]
call fcn.140137f30
lea rcx, [0x14019526c]
call fcn.140149d90
mov qword [rbp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x40], rax
mov r9d, 5
mov r8, r13
mov rdx, r13
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x48]
call fcn.140137f30
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rbx, rax
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055c65
mov r9, qword [rbx]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [r9 + 0x18]
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055c88
mov rax, qword [rbx]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rbp + 0x200]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055cac
mov rax, qword [rbx]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x88]
call fcn.140137f30
nop
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x98]
call fcn.140137f30
nop
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0xa8]
call fcn.140137f30
nop
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a90]
cmp byte [rax + 0xe9e0], r12b
je 0x140055e1e
mov rax, qword [0x1401fb428]
test rax, rax
jne 0x140055d82
lea ecx, [rax + 0x30]
call fcn.140131308
mov qword [rbp + 0xf0], rax
mov rcx, rax
call fcn.14007c2e0
nop
mov qword [0x1401fb428], rax
cmp byte [rax + 0x15], 0
jne 0x140055db3
movzx ecx, byte [rax + 0x10]
test cl, cl
je 0x140055ddb
cmp byte [rax + 0xd], 0
jne 0x140055db3
cmp byte [rax + 0xb], 0
jne 0x140055da2
cmp byte [rax + 0xc], 0
je 0x140055da8
cmp byte [rax + 0xf], 0
je 0x140055db3
cmp cl, 1
jne 0x140055ddb
cmp byte [rax + 0xf], 0
jne 0x140055ddb
mov rax, qword [rdi + 0x10a90]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055e1e
cmp qword [rcx + 0x20], 0
jne 0x140055ddb
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
jmp 0x140055e1e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov edx, eax
sub edx, dword [rdi + 0x10b7c]
cmp edx, 0x1f4
jbe 0x140055e1e
mov rcx, qword [rdi + 0x10a90]
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov dword [rdi + 0x10b7c], ebx
mov r15d, dword [rsp + 0x34]
mov r14d, 0x421
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
cmp byte [rdi + 0x10a98], 0
je 0x140055e4b
mov eax, dword [rsp + 0x50]
jmp 0x140054650
lea r13, vtable.rfb::ClippedUpdateTracker.0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov byte [rdi + 0x10a98], 0
mov rcx, qword [rdi + 0x10aa8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov byte [0x1401f2eb8], 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140055e99
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r12
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140055eb9
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140055ed9
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10a90]
mov dword [rax + 0xe4cc], r12d
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rbx, qword [rdi + 0x10a90]
mov rax, qword [0x1401fdf60]
cmp dword [rax + 0x798], 0
je 0x140055f3e
cmp dword [rax + 0x79c], 0
jne 0x140055f3e
movzx r9d, byte [rbx + 0xe9e1]
mov r8b, 1
xor edx, edx
call fcn.1400233d0
mov byte [rbx + 0xe9e1], al
mov byte [rbx + 0xeab0], 0
mov byte [rbx + 0xeaba], 0
mov r8d, esi
mov rcx, qword [rbx + 0xe450]
call fcn.140085ea0
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:SetBlockInputState_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov cl, 0xa0
call fcn.140075a30
mov cl, 0xa2
call fcn.140075a30
mov cl, 0xa4
call fcn.140075a30
mov cl, 0xa1
call fcn.140075a30
mov cl, 0xa3
call fcn.140075a30
mov cl, 0xa5
call fcn.140075a30
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:ClearShiftKeys_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
xor edx, edx
lea rcx, str.blackscreen
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055fe0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov byte [0x1401f2ebb], 0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:g_DesktopThread_runningfalse_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
mov rcx, qword [rdi + 0x10a90]
call fcn.14004c880
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:m_desktop__Shutdown_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140017a50
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x48]
call fcn.140137f30
nop
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 8]
call fcn.140137f30
lea rax, vtable.rfb::UpdateTracker.0
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x60], r14
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x30]
call fcn.140137f30
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x40]
call fcn.140137f30
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x50]
call fcn.140137f30
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1401312e0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140137eb8
nop
int3