Function at 0x1400541b0
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check os version
Create thread
Power down monitor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov rax, qword [0x1401fdf80]
mov ecx, dword [rax + 0xe60]
cmp ecx, 1
jne 0x1400542d9
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x14005422a
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
cmp byte [rax + 0xc], 0
jne 0x1400542cf
test rax, rax
jne 0x14005425e
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
jmp 0x140054261
mov rax, rcx
cmp byte [rax + 0xb], 0
jne 0x1400542cf
test rcx, rcx
jne 0x140054290
mov ecx, gethostbyname
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
jmp 0x140054293
mov rax, rcx
cmp byte [rax + 0xa], 0
jne 0x1400542cf
test rcx, rcx
jne 0x1400542bf
mov ecx, gethostbyname
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
mov rcx, rax
mov qword [0x1401fb448], rax
cmp byte [rcx + 8], 0
jne 0x1400542cf
mov al, 1
mov byte [0x1401f2920], al
jmp 0x1400542e3
xor al, al
mov byte [0x1401f2920], al
jmp 0x1400542e3
cmp ecx, 2
sete byte [0x1401f2920]
mov byte [rdi + 0x10b68], 1
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_1_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xeac8], rax
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed_2_n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov dword [rbp + 0x110], __WSAFDIsSet
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14005440e
lea r8, str.vncDesktop::KillScreenSaver_:_KillScreenSaver..._n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov eax, dword [rbp + 0x120]
sub eax, 1
je 0x1400543e7
cmp eax, 1
jne 0x14005440e
mov r9d, 0x81
xor r8d, r8d
xor edx, edx
lea rcx, str.Screen_saver
call qword [sym.imp.USER32.dll_OpenDesktopA]
mov rbx, rax
test rax, rax
je 0x14005440e
lea r8, str.vncDesktop::KillScreenSaver_:_Killing_ScreenSaver_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor r8d, r8d
lea rdx, [0x14004d1d0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 - 1]
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x14005440e
xor edx, edx
lea rcx, str.WindowsScreenSaverClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005440e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
xor r8d, r8d
xor edx, edx
mov cl, select
call fcn.14002fc90
xor edx, edx
lea r8d, [rdx + 2]
mov cl, select
call fcn.14002fc90
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x10a80]
call fcn.14004c9a0
mov ebx, eax
test eax, eax
je 0x140054480
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xeac8]
call fcn.1400211c0
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xeac0]
test rcx, rcx
je 0x140054470
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
call qword [rax + 0x20]
jmp 0x140056719
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x20]
mov rax, qword [0x1401fdf80]
mov r8d, dword [rax + 0xe50]
mov edx, dword [rax + 0xe54]
mov rcx, qword [rdi + 0x10a80]
call fcn.14004fbc0
mov byte [rdi + 0x10b69], 0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov qword [rbp - 0x60], r14
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp - 0x50], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x58], rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp - 0x40], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x48], rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp - 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp - 0x38], rax
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x20], r12b
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
lea r13, vtable.rfb::ClippedUpdateTracker.0
mov qword [rbp - 0x10], r13
lea rax, [rbp - 0x60]
mov qword [rbp - 8], rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp], rax
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov byte [rbp - 0x20], 1
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rsp + 0x40], rax
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
lea r9d, [r12 + 5]
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rdi + 0x10a80]
mov r10, qword [rcx]
cmp dword [rax + 0xeab4], 1
sete r9b
mov r8d, dword [rax + 0x894]
mov edx, dword [rax + 0x890]
call qword [r10 + 0xe8]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbp + 0xc8]
mov qword [rdi + 0x10a8c], rax
mov rdx, qword [rdi + 0x10a80]
mov rax, qword [rdx + 0xe458]
test rax, rax
je 0x14005471e
cmp qword [rax + 0x20], r12
je 0x14005470a
cmp dword [rdx + 0x8d0], r12d
je 0x14005471e
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
mov r8d, dword [rdx + 0xe9ac]
mov edx, dword [rdx + 0xe9a8]
call qword [rax + 0xe0]
mov rax, qword [rdi + 0x10a80]
mov qword [rax + 0x808], 4
jmp 0x14005471e
mov dword [rdx + 0xe9ec], 1
mov dword [rdx + 0xe9f0], 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f0], 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe978], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9ec], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f4], r12d
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f8], r12d
mov ebx, r12d
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
jne 0x1400547bb
nop
mov ecx, Ordinal_102
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jg 0x1400547bb
lea r8, str.vncDesktopThread::run_undetached_:_Wait_for_viewer_init__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0xf8]
test eax, eax
je 0x140054780
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10af0], dl
test eax, eax
jne 0x140054801
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054801
mov rax, qword [rcx]
call qword [rax + 0x18]
movzx edx, byte [rdi + 0x10af0]
test dl, dl
je 0x140054839
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054829
mov rax, qword [rcx]
call qword [rax + 0x20]
movzx edx, byte [rdi + 0x10af0]
test dl, dl
je 0x140054839
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10af8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10afc], eax
mov r15d, r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
mov byte [0x1401f2ed8], r15b
mov byte [rdi + 0x10a88], 1
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
cmp byte [0x1401f2eda], r12b
jne 0x140054a55
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400549d1
cmp qword [rcx + 0x20], r15
je 0x1400549b7
cmp dword [rax + 0x8d0], r12d
je 0x1400549d1
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x140054958
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x1400549d8
test rax, rax
jne 0x140054989
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
mov esi, 1
cmp byte [rcx + 8], 0
jne 0x1400549dd
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
mov r9d, esi
mov r8d, esi
lea rdx, [rsp + 0x40]
call fcn.140035f70
jmp 0x140054a5a
mov esi, 1
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fb448]
jmp 0x1400549dd
mov rax, qword [0x1401fb448]
mov esi, 1
test rax, rax
jne 0x1400549ff
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x140054a5a
test rax, rax
jne 0x140054a2c
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
jmp 0x140054a2f
mov rax, rcx
cmp byte [rax + 8], 0
jne 0x140054a5a
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
mov r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140035f70
jmp 0x140054a5a
mov esi, 1
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe4cc], esi
mov qword [rbp + 0x28], r12
mov qword [rbp - 0x68], r12
mov rax, qword [0x1401fdf80]
cmp dword [rax + 0xa58], 0
mov ecx, 0x80000043
jne 0x140054a89
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140054b8e
cmp qword [rcx + 0x20], 0
je 0x140054b82
cmp dword [rax + 0x8d0], 0
je 0x140054b8e
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x140054ae7
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
mov rdx, rax
cmp byte [rax + 0xa], 0
jne 0x140054b95
test rax, rax
jne 0x140054b1c
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
cmp byte [rcx + 8], 0
jne 0x140054b95
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400540c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0xb4]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140054140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
jmp 0x140054cb4
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [0x1401fb448]
mov rcx, qword [rdi + 0x10a80]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140054e00
cmp qword [rdx + 0x20], 0
je 0x140054df4
cmp dword [rcx + 0x8d0], 0
je 0x140054e00
test rax, rax
jne 0x140054be6
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
mov rcx, rax
cmp byte [rax + 0xa], 0
jne 0x140054c20
test rax, rax
jne 0x140054c13
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rsp + 0x38], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
jmp 0x140054c16
mov rax, rcx
cmp byte [rax + 8], 0
je 0x140054e00
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xe3e8], rax
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 0x10a80]
mov qword [rcx + 0xe3f0], rax
mov eax, 0x3e8
mov dword [rsp + 0x50], eax
cmp byte [rdi + 0x10af0], 0
je 0x140054cb4
mov rax, qword [rdi + 0x10a80]
cmp qword [rax + 0xe458], 0
je 0x140054cb0
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140054140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, dword [rsp + 0x50]
cmp byte [rdi + 0x10a88], 0
je 0x1400564d9
mov r14d, 0x421
nop word [rax + rax]
cmp byte [0x1401f32e3], 0
jne 0x1400564cb
mov rdx, qword [rdi + 0x10a80]
add rdx, 0xe3b8
mov r9d, eax
xor r8d, r8d
lea ecx, [r8 + 8]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, qword [rdi + 0x10a80]
mov edx, 0x2710
mov rcx, qword [rcx + 0xe408]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140054d24
mov byte [rdi + 0x10a88], 0
cmp ebx, 5
ja 0x140054ee8
je 0x140054ec8
test ebx, ebx
je 0x140054f97
sub ebx, 1
je 0x140054e50
sub ebx, 1
je 0x140054e37
sub ebx, 1
je 0x140054f27
cmp ebx, 1
jne 0x1400564b4
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], bl
mov rbx, qword [rdi + 0x10a80]
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 0
jmp 0x1400564b4
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
lea rax, [rbp + 0xbc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x140054140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
mov eax, 0x21
mov dword [rsp + 0x50], eax
jmp 0x140054cb4
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3c8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1400564b4
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3c0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 1
mov r8, qword [rdi + 0x10a80]
mov r9d, 2
mov r8, qword [r8 + 0xe418]
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, qword [rdi + 0x10a80]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xe418]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a80]
mov byte [rax + 0xe428], 0
jmp 0x1400564b4
mov byte [rdi + 0x10a88], 0
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3e0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1400564b4
cmp ebx, 6
je 0x140054f6b
cmp ebx, 7
je 0x140054f13
cmp ebx, 0x102
je 0x140054f97
cmp ebx, 0xffffffff
jne 0x1400564b4
mov byte [rdi + 0x10a88], 0
jmp 0x1400564b4
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3f0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rdi + 0x10ae8]
test rax, rax
je 0x140054f52
mov dword [rbp - 0x80], 0x18
lea rcx, [rbp - 0x80]
call rax
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rbp - 0x78]
mov qword [rcx + 0xe960], rax
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3d0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1400564b4
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3e8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r8, str.ddengine
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x1401f32e8]
call fcn.1401462c0
mov rcx, qword [rdi + 0x10a80]
mov rcx, qword [rcx + 0xe3b8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [0x1401fdf80]
cmp dword [rax + 0xe48], 0x64
je 0x14005502b
cmp r15d, 0xa
ja 0x140055035
bt r14d, r15d
jae 0x140055035
lea rcx, [rdi + 0x10b08]
call fcn.1400193d0
mov word [rdi + 0x10b58], ax
mov r8d, dword [rdi + 0x10b5c]
movsx ecx, ax
mov rax, qword [0x1401fdf80]
cmp ecx, dword [rax + 0xe48]
lea eax, [r8 + 0xa]
jg 0x140054ffb
lea eax, [r8 - 0xa]
lea r8, [rdi + 0x10b5c]
mov ecx, eax
mov dword [r8], eax
mov ecx, dword [rdi + 0x10b64]
cmp eax, ecx
jae 0x140055019
mov dword [rdi + 0x10b5c], ecx
mov eax, ecx
mov ecx, dword [rdi + 0x10b60]
cmp eax, ecx
jbe 0x140055035
mov dword [rdi + 0x10b5c], ecx
jmp 0x140055035
mov dword [rdi + 0x10b5c], 0x19
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x10af4], eax
mov ecx, dword [rdi + 0x10af8]
mov r8d, dword [rdi + 0x10b5c]
mov edx, eax
sub edx, ecx
cmp edx, r8d
jae 0x140055062
sub ecx, eax
add ecx, r8d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x1400550a5
cmp qword [rcx + 0x20], 0
je 0x140055099
cmp dword [rax + 0x8d0], 0
je 0x1400550a5
mov rax, qword [rdi]
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x1400550a5
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
mov rax, qword [rdi + 0x10a80]
cmp dword [rax + 0xe9f0], 0
je 0x14005511b
cmp dword [rax + 0xe9ec], 0
jne 0x14005511b
lea r8, str.vncDesktopThread::run_undetached_:_Hook_changed__n
xor edx, edx
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rdi + 0x10a80]
movsxd r8, dword [rcx + 0xe9e8]
xor r9d, r9d
mov edx, 0x8007
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [rdi + 0x10a80]
cmp dword [rax + 0xe9e8], 0
je 0x140055114
mov qword [rax + 0xe968], r12
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe9f0], r12d
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x250]
test al, al
jne 0x14005515d
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140052e80
test al, al
jne 0x14005515d
mov byte [rdi + 0x10a88], al
jmp 0x1400564b4
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x238]
mov rcx, qword [rdi + 0x10a80]
mov byte [rcx + 0x8d4], al
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x240]
mov rcx, qword [rdi + 0x10a80]
mov byte [rcx + 0x8d5], al
mov rax, qword [rdi + 0x10a80]
add rax, 0xe4e8
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0x113
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
jne 0x1400551f9
cmp byte [rdi + 0x10b69], al
jne 0x1400564a9
mov eax, dword [rdi + 0x10af4]
mov dword [rdi + 0x10af8], eax
xor r14b, r14b
mov byte [rsp + 0x30], r14b
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14005528c
mov rax, qword [rbp + 0x50]
cmp eax, dword [rdi + 0x10a8c]
jne 0x140055232
mov ecx, dword [rdi + 0x10a90]
cmp dword [rbp + 0x54], ecx
je 0x14005528c
mov r14b, 1
mov byte [rsp + 0x30], r14b
mov qword [rdi + 0x10a8c], rax
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rax, qword [rdi + 0x10ae8]
test rax, rax
je 0x14005528c
mov dword [rbp + 0xf8], 0x18
lea rcx, [rbp + 0xf8]
call rax
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rbp + 0x100]
mov qword [rcx + 0xe960], rax
xor r13b, r13b
mov r8, qword [rdi + 0x10a80]
cmp dword [r8 + 0x8d0], 0
jne 0x1400552c1
lea rdx, [rbp - 0x10]
mov rcx, r8
call fcn.14004f120
movzx r13d, al
mov r8, qword [rdi + 0x10a80]
cmp dword [r8 + 0x8d0], 0
je 0x140055327
cmp byte [r8 + 0xea78], 0
je 0x140055327
cmp dword [r8 + 0xea68], 0
jne 0x140055327
mov rax, qword [0x1401fdf80]
test r14b, r14b
je 0x140055300
mov ecx, r12d
cmp dword [rax + 0xe30], 0
setne cl
inc ecx
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x140055359
mov ecx, 2
cmp dword [rax + 0xe30], 0
mov eax, 4
cmovne ecx, eax
mov dword [r8 + 0x808], ecx
mov dword [r8 + 0x80c], r12d
jmp 0x14005547a
test r13b, r13b
jne 0x140055350
mov byte [rsp + 0x20], r14b
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140053cc0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
test r14b, r14b
je 0x14005547a
mov rcx, qword [rdi + 0x10a80]
cmp dword [rcx + 0x8d0], 0
jne 0x14005547a
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x14005547a
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x14005547a
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x1400553d8
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x1400553e6
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x1400553fb
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x14005540f
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x140055477
test edx, edx
jle 0x140055477
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019528c]
call fcn.140145b50
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140139270
movzx r14d, byte [rsp + 0x30]
mov esi, 1
xor r12d, r12d
mov rax, qword [rdi + 0x10a80]
add rax, 0xe4e8
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], 0x114
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x1401fdf80]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b58]
cmp ecx, eax
jge 0x1400554e4
mov rcx, qword [rdi + 0x10a80]
cmp dword [rcx + 0x8d0], 0
jne 0x1400554e4
test r13b, r13b
jne 0x1400554e4
lea rdx, [rbp - 0x10]
call fcn.14004f120
movzx eax, byte [0x1401f2eda]
test al, al
je 0x140055538
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x248]
test al, al
je 0x14005552d
mov rcx, qword [rdi + 0x10a80]
mov r8d, dword [rcx + 0x838]
mov rdx, qword [rcx + 0x870]
mov rcx, qword [rcx + 0x878]
call fcn.14004df30
jmp 0x140055593
movzx eax, byte [0x1401f2eda]
test al, al
jne 0x140055593
mov rcx, qword [rdi + 0x10a80]
mov rdx, qword [rcx + 0xe458]
test rdx, rdx
je 0x140055573
cmp qword [rdx + 0x20], 0
je 0x140055560
cmp dword [rcx + 0x8d0], 0
je 0x140055573
mov r8d, esi
jmp 0x14005557a
mov dword [rcx + 0xe9ec], esi
mov dword [rcx + 0xe9f0], esi
mov rcx, qword [rdi + 0x10a80]
test al, al
jne 0x140055593
xor r8d, r8d
movzx r9d, byte [rdi + 0x10b68]
lea rdx, [rsp + 0x40]
add rcx, 0x7e8
call fcn.140035f70
mov byte [rdi + 0x10b68], 1
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov ecx, r12d
cmp byte [rdi + 0x10af0], 0
sete cl
cmp ecx, eax
jne 0x140055606
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
test eax, eax
setne dl
mov byte [rdi + 0x10af0], dl
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140055606
mov rax, qword [rcx]
test dl, dl
jne 0x140055603
call qword [rax + 0x18]
jmp 0x140055606
call qword [rax + 0x20]
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x220]
mov rcx, qword [rdi + 0x10a80]
test eax, eax
je 0x140055815
mov rax, qword [rcx + 0xe968]
cmp qword [rcx + 0xe960], rax
jne 0x140055651
mov eax, dword [rcx + 0x880]
mov dword [rcx + 0x880], r12d
test eax, eax
je 0x1400559ba
mov rcx, qword [rdi + 0x10a80]
mov rax, qword [rcx + 0xe960]
mov qword [rcx + 0xe968], rax
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0x810], esi
mov rsi, qword [rdi + 0x10a80]
cmp dword [rsi + 0x8d0], 0
je 0x14005568c
cmp byte [rsi + 0xea78], 0
jne 0x1400556f5
add rsi, 0x7e8
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x1400556af
cmp qword [rsi + 0x88], rcx
jne 0x1400556b8
cmp qword [rsi + 0x88], rcx
je 0x1400556c4
mov rcx, rsi
call fcn.1400353a0
test eax, eax
je 0x1400556f5
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004eb50
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140036500
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a80]
mov r11d, dword [rcx + 0xe42c]
mov r8d, dword [rcx + 0xe434]
sub r8d, r11d
mov r15d, dword [rcx + 0xe430]
mov edx, dword [rcx + 0xe438]
sub edx, r15d
mov r10d, dword [rcx + 0xe514]
mov esi, dword [rcx + 0xe51c]
add esi, r10d
mov r9d, dword [rcx + 0xe510]
mov ebx, dword [rcx + 0xe518]
add ebx, r9d
cmp r11d, r9d
jge 0x140055762
mov eax, r11d
sub eax, r9d
add r8d, eax
mov r12d, r9d
cmp r11d, r9d
cmovge r12d, r11d
cmp r15d, r10d
jge 0x14005577a
sub r15d, r10d
add edx, r15d
mov r15d, r10d
lea ecx, [rbx + r9]
lea eax, [r8 + r12]
cmp eax, ecx
jle 0x14005578f
mov r8d, ebx
sub r8d, r12d
add r8d, r9d
lea ecx, [rdx + r15]
lea eax, [r10 + rsi]
cmp ecx, eax
jle 0x1400557a3
mov edx, r10d
sub edx, r15d
add edx, esi
test r8d, r8d
jle 0x140055800
test edx, edx
jle 0x140055800
lea esi, [r8 + r12]
lea ebx, [rdx + r15]
lea rcx, [0x14019528c]
call fcn.140145b50
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140139270
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
jmp 0x1400559ba
cmp dword [rcx + 0x8d0], 0
je 0x14005582b
cmp byte [rcx + 0xea78], 0
jne 0x1400559ba
lea rsi, [rcx + 0x7e8]
mov rax, qword [rsi + 0x90]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x14005584e
cmp qword [rsi + 0x88], rcx
jne 0x140055857
cmp qword [rsi + 0x88], rcx
je 0x140055863
mov rcx, rsi
call fcn.1400353a0
test eax, eax
je 0x140055894
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x90]
call fcn.14004eb50
mov rax, qword [rsi + 0x90]
movups xmm0, xmmword [rax + 0xe42c]
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140036500
test r14b, r14b
je 0x1400559ba
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe450]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rcx, qword [rdi + 0x10a80]
mov r15d, dword [rcx + 0xe42c]
cmp r15d, dword [rcx + 0xe434]
jge 0x1400559ba
mov eax, dword [rcx + 0xe438]
cmp dword [rcx + 0xe430], eax
jge 0x1400559ba
mov r8d, dword [rcx + 0xe434]
sub r8d, r15d
mov r12d, dword [rcx + 0xe430]
mov edx, eax
sub edx, r12d
mov r9d, dword [rcx + 0xe514]
mov ebx, dword [rcx + 0xe51c]
add ebx, r9d
mov r10d, dword [rcx + 0xe510]
mov r11d, dword [rcx + 0xe518]
add r11d, r10d
cmp r15d, r10d
jge 0x140055926
sub r15d, r10d
add r8d, r15d
mov r15d, r10d
cmp r12d, r9d
jge 0x140055934
sub r12d, r9d
add edx, r12d
mov r12d, r9d
lea ecx, [r11 + r10]
lea eax, [r8 + r15]
cmp eax, ecx
jle 0x140055949
mov r8d, r11d
sub r8d, r15d
add r8d, r10d
lea ecx, [rdx + r12]
lea eax, [rbx + r9]
cmp ecx, eax
jle 0x14005595d
mov edx, ebx
sub edx, r12d
add edx, r9d
test r8d, r8d
jle 0x1400559ba
test edx, edx
jle 0x1400559ba
lea esi, [r8 + r15]
lea ebx, [rdx + r12]
lea rcx, [0x14019528c]
call fcn.140145b50
mov r14, rax
mov r9d, ebx
mov r8d, esi
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call fcn.140139270
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r15, rax
mov qword [rbp + 0xa0], rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 0x98], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r12, rax
mov qword [rbp + 0x90], rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 0x88], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r13, rax
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
xor r14d, r14d
cmp eax, 1
je 0x140055ae8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140027190
mov rbx, qword [rbp + 0x128]
cmp rbx, qword [rbp + 0x130]
je 0x140055adc
mov rcx, qword [rdi + 0x10a80]
add rcx, 0x7e8
lea r8, [rbp + 0x140]
mov rdx, rbx
call fcn.140036db0
add rbx, 0x10
cmp rbx, qword [rbp + 0x130]
jne 0x140055ab2
lea rcx, [rbp + 0x110]
call fcn.140046500
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 4
mov r8, qword [rbp - 0x38]
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140055f25
mov rax, qword [0x1401fdf80]
mov eax, dword [rax + 0xe48]
cdq
sub eax, edx
sar eax, 1
movsx ecx, word [rdi + 0x10b58]
cmp ecx, eax
jge 0x140055f25
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], r14
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.140027190
mov r13, qword [rbp + 0x128]
cmp r13, qword [rbp + 0x130]
je 0x140055f10
add r13, 0xc
nop
mov r12d, dword [r13 - 4]
add r12d, 4
mov dword [rsp + 0x68], r12d
mov r8d, dword [r13]
add r8d, 4
mov dword [rsp + 0x6c], r8d
mov ecx, dword [r13 - 0xc]
add ecx, 0xfffffffc
mov dword [rsp + 0x60], ecx
mov r9d, dword [r13 - 8]
add r9d, 0xfffffffc
mov dword [rsp + 0x64], r9d
mov rdx, qword [rdi + 0x10a80]
cmp qword [rdx + 0xe458], 0
je 0x140055cb8
add rdx, 0x8d8
lea rax, [rsp + 0x60]
cmp ecx, dword [rdx]
cmovl rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x60], eax
lea rax, [rdx + 4]
lea rcx, [rsp + 0x64]
cmp r9d, dword [rax]
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x64], eax
lea rax, [rdx + 8]
lea rcx, [rsp + 0x68]
cmp dword [rax], r12d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x68], eax
lea rax, [rdx + 0xc]
lea rcx, [rsp + 0x6c]
cmp dword [rax], r8d
cmovl rcx, rax
mov eax, dword [rcx]
mov dword [rbp + 0x6c], eax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r12d, dword [rsp + 0x68]
lea rcx, [0x14019528c]
call fcn.140145b50
mov r15, rax
mov r9d, dword [rsp + 0x6c]
mov r8d, r12d
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call fcn.140139270
mov ecx, dword [rbp + 0x144]
neg ecx
mov eax, dword [rbp + 0x140]
neg eax
mov r10d, dword [rsp + 0x6c]
add r10d, ecx
lea r9d, [rax + r12]
mov dword [rbp + 0x20], r9d
mov dword [rbp + 0x24], r10d
mov edx, dword [rsp + 0x64]
add edx, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x14], edx
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x18], rax
mov r8, qword [rdi + 0x10a80]
add r8, 0x8d8
lea rax, [rbp + 0x10]
cmp ecx, dword [r8]
cmovl rax, r8
mov r15d, dword [rax]
mov dword [rbp + 0x70], r15d
lea rax, [r8 + 4]
lea rcx, [rbp + 0x14]
cmp edx, dword [rax]
cmovl rcx, rax
mov r14d, dword [rcx]
mov dword [rbp + 0x74], r14d
lea rax, [r8 + 8]
lea rcx, [rbp + 0x18]
cmp dword [rax], r9d
cmovl rcx, rax
mov esi, dword [rcx]
mov dword [rbp + 0x78], esi
lea rax, [r8 + 0xc]
lea r9, [rbp + 0x1c]
cmp dword [rax], r10d
cmovl r9, rax
mov ebx, dword [r9]
mov dword [rbp + 0x7c], ebx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x14019528c]
call fcn.140145b50
mov r12, rax
mov r9d, ebx
mov r8d, esi
mov edx, r14d
mov ecx, r15d
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov r14, rax
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 5
mov rdx, qword [rsp + 0x40]
mov r8, rdx
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, 2
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov r8, rbx
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call fcn.140139270
add r13, 0x10
lea rax, [r13 - 0xc]
cmp rax, qword [rbp + 0x130]
jne 0x140055c10
mov r15, qword [rbp + 0xa0]
mov r12, qword [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.140046500
mov r13, qword [rbp + 0x80]
jmp 0x140055f55
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov r9d, 5
mov rdx, qword [rbp - 0x38]
mov r8, rdx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_CombineRgn]
lea rdx, [rbp + 0x1d0]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140056143
mov rbx, qword [rdi + 0x10a80]
mov rcx, qword [rbx + 0xe458]
test rcx, rcx
je 0x140055f8e
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rdi + 0x10a80]
xor r14b, r14b
mov rsi, rbx
cmp byte [rbx + 0x8d5], r14b
je 0x140056018
inc dword [rdi + 0x98]
cmp dword [rdi + 0x98], 0xa
jle 0x140056018
mov dword [rdi + 0x98], 0
lea rcx, [0x14019528c]
call fcn.140145b50
mov rsi, rax
mov r9d, dword [rbx + 0x8e4]
mov r8d, dword [rbx + 0x8e0]
mov edx, dword [rbx + 0x8dc]
mov ecx, dword [rbx + 0x8d8]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov rbx, rax
mov r9d, 2
mov r8, rax
mov rdx, r15
mov rcx, r15
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call fcn.140139270
mov r14b, 1
mov rsi, qword [rdi + 0x10a80]
mov rax, qword [rsi + 0x878]
mov rcx, qword [rax + 0xe980]
test rcx, rcx
je 0x140056034
cmp qword [rsi + 0x870], rcx
jne 0x14005603d
cmp qword [rsi + 0x870], rcx
je 0x140056051
lea rcx, [rsi + 0x7e8]
call fcn.1400353a0
test eax, eax
je 0x14005612a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0
mov r9b, 1
movzx r8d, r9b
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xa0]
call fcn.140025be0
mov rbx, qword [rbp - 0x80]
cmp rbx, qword [rbp - 0x78]
jne 0x1400560c0
test rbx, rbx
je 0x14005612a
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400560bb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005674b
mov rcx, rbx
jmp 0x140056125
mov byte [rsp + 0x20], r14b
mov r9, rbx
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x7e8]
call fcn.140035760
add rbx, 0x10
cmp rbx, qword [rbp - 0x78]
jne 0x1400560c0
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14005612a
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056125
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005674b
call fcn.140132684
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x140056143
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rsi, qword [rdi + 0x10a98]
mov rax, qword [rsi + 0x130]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14005618d
nop dword [rax]
mov rax, qword [rsi]
movzx edx, word [rbx + 0x10]
mov rcx, rsi
call qword [rax + 0x90]
mov byte [rax + 0x3ac], 1
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsi + 0x130]
jne 0x140056160
mov rsi, qword [rdi + 0x10a98]
cmp byte [rdi + 0x10b69], 0
jne 0x1400561c5
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
call qword [rax + 0xf0]
mov byte [rdi + 0x10b69], 1
mov rcx, qword [rdi + 0x10a80]
mov eax, Ordinal_102
cmp dword [rcx], eax
mov esi, 1
cmove eax, esi
mov dword [rcx], eax
jmp 0x1400561ca
mov esi, 1
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 0x38], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x30], rax
mov r9d, 5
mov r8, r12
mov rdx, r12
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x30]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x38]
call fcn.140139270
lea rcx, [0x14019528c]
call fcn.140145b50
mov qword [rbp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 0x40], rax
mov r9d, 5
mov r8, r13
mov rdx, r13
mov rcx, rax
call qword [sym.imp.GDI32.dll_CombineRgn]
mov r9d, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 0x40]
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
nop
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x48]
call fcn.140139270
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rbx, rax
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x1400562e5
mov r9, qword [rbx]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [r9 + 0x18]
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x140056308
mov rax, qword [rbx]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rbp + 0x200]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x14005632c
mov rax, qword [rbx]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x88]
call fcn.140139270
nop
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x98]
call fcn.140139270
nop
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0xa8]
call fcn.140139270
nop
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_SetRectRgn]
mov rax, qword [rdi + 0x10a80]
cmp byte [rax + 0xe9e0], r12b
je 0x14005649e
mov rax, qword [0x1401fb448]
test rax, rax
jne 0x140056402
lea ecx, [rax + 0x30]
call fcn.140132648
mov qword [rbp + 0xf0], rax
mov rcx, rax
call fcn.14007c970
nop
mov qword [0x1401fb448], rax
cmp byte [rax + 0x15], 0
jne 0x140056433
movzx ecx, byte [rax + 0x10]
test cl, cl
je 0x14005645b
cmp byte [rax + 0xd], 0
jne 0x140056433
cmp byte [rax + 0xb], 0
jne 0x140056422
cmp byte [rax + 0xc], 0
je 0x140056428
cmp byte [rax + 0xf], 0
je 0x140056433
cmp cl, 1
jne 0x14005645b
cmp byte [rax + 0xf], 0
jne 0x14005645b
mov rax, qword [rdi + 0x10a80]
mov rcx, qword [rax + 0xe458]
test rcx, rcx
je 0x14005649e
cmp qword [rcx + 0x20], 0
jne 0x14005645b
mov dword [rax + 0xe9ec], esi
mov dword [rax + 0xe9f0], esi
jmp 0x14005649e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov edx, eax
sub edx, dword [rdi + 0x10b6c]
cmp edx, 0x1f4
jbe 0x14005649e
mov rcx, qword [rdi + 0x10a80]
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov rcx, qword [rcx + 0xe4b8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov dword [rdi + 0x10b6c], ebx
mov r15d, dword [rsp + 0x34]
mov r14d, 0x421
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 1
cmp byte [rdi + 0x10a88], 0
je 0x1400564cb
mov eax, dword [rsp + 0x50]
jmp 0x140054cd0
lea r13, vtable.rfb::ClippedUpdateTracker.0
lea r14, vtable.rfb::SimpleUpdateTracker.0
mov byte [rdi + 0x10a88], 0
mov rcx, qword [rdi + 0x10a98]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov byte [0x1401f2ed8], 1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140056519
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r12
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140056539
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140056559
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10a80]
mov dword [rax + 0xe4cc], r12d
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rbx, qword [rdi + 0x10a80]
mov rax, qword [0x1401fdf80]
cmp dword [rax + 0x798], 0
je 0x1400565be
cmp dword [rax + 0x79c], 0
jne 0x1400565be
movzx r9d, byte [rbx + 0xe9e1]
mov r8b, 1
xor edx, edx
call fcn.1400239e0
mov byte [rbx + 0xe9e1], al
mov byte [rbx + 0xeab0], 0
mov byte [rbx + 0xeaba], 0
mov r8d, esi
mov rcx, qword [rbx + 0xe450]
call fcn.1400868e0
mov ecx, 0x80000000
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:SetBlockInputState_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov cl, 0xa0
call fcn.1400760b0
mov cl, 0xa2
call fcn.1400760b0
mov cl, 0xa4
call fcn.1400760b0
mov cl, 0xa1
call fcn.1400760b0
mov cl, 0xa3
call fcn.1400760b0
mov cl, 0xa5
call fcn.1400760b0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:ClearShiftKeys_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
xor edx, edx
lea rcx, str.blackscreen
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056660
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov byte [0x1401f2edb], 0
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:g_DesktopThread_runningfalse_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
mov rcx, qword [rdi + 0x10a80]
call fcn.14004cf00
lea r8, str.vncDesktopThread::run_undetached_:_quitting_desktop_server_thread:m_desktop__Shutdown_n
mov edx, 9
lea rcx, vtable.VNCLog.0
call fcn.140018c00
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x48]
call fcn.140139270
nop
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 8]
call fcn.140139270
lea rax, vtable.rfb::UpdateTracker.0
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x60], r14
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x30]
call fcn.140139270
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x40]
call fcn.140139270
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp - 0x50]
call fcn.140139270
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401391f8
nop
int3