Function at 0x426e80
Capabilities:
Check for unmoving mouse cursor
Power down monitor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49aa80
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ba700]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
mov ebp, ecx
push str.._vncdesktopthread.cpp_:_Hook_changed_1_n
xor ecx, ecx
mov eax, 0x4bc990
mov byte [ebp + 0x10aa4], 1
call fcn.00401110
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov ecx, dword [ebp + 0x10a18]
mov dword [ecx + 0xe234], eax
push str.._vncdesktopthread.cpp_:_Hook_changed_2_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
call fcn.00420580
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x11
call esi
push 0
push 2
push 0
push 0x11
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0x10a18]
call fcn.0041fe40
mov edi, eax
test edi, edi
je 0x426f70
mov edx, dword [ebp + 0x10a18]
mov esi, dword [edx + 0xe234]
call fcn.004516a0
mov eax, dword [ebp + 0x10a18]
mov eax, dword [eax + 0xe230]
test eax, eax
je 0x426f60
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov edx, dword [ebp]
mov eax, dword [edx + 0x10]
push edi
mov ecx, ebp
call eax
jmp 0x42869f
mov edx, dword [ebp]
mov eax, dword [edx + 0x10]
push 0
mov ecx, ebp
call eax
mov esi, dword [ebp + 0x10a18]
mov ecx, dword [esi + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc8]
mov edi, ecx
call eax
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [edx + 0xd0]
mov ecx, edi
call eax
push eax
mov ecx, ebx
mov edx, esi
call fcn.00422730
mov eax, dword [ebp + 0x10a18]
lea esi, [esp + 0xb8]
mov dword [eax + 0xdc1c], 1
call fcn.0040a4f0
mov dword [esp + 0x1d8], 0
mov esi, dword [ebp + 0x10a18]
push 0x4a3fbe
add esi, 0xa8
call fcn.0047d6d1
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgn]
add esp, 4
push ecx
mov ecx, dword [esi]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 4]
push edx
push eax
push ecx
call edi
lea edx, [esp + 0xb8]
push 0x4a3fbe
mov esi, eax
mov dword [esp + 0x54], vtable.rfb::ClippedUpdateTracker.0
mov dword [esp + 0x58], edx
call fcn.0047d6d1
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esp + 0x6c], eax
call edi
push 5
push esi
push esi
push eax
mov dword [esp + 0x68], eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call ebx
mov eax, dword [esp + 0x3c]
push eax
call fcn.0047d643
add esp, 4
push 0x4a3fbe
mov byte [esp + 0xe0], 1
call fcn.0047d6d1
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esp + 0x30], eax
call edi
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1d8], 2
mov esi, dword [ebp + 0x10a18]
push 0x4a3fbe
add esi, 0xa8
call fcn.0047d6d1
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
add esp, 4
push ecx
mov ecx, dword [esi]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 4]
push edx
push eax
push ecx
call edi
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push edx
mov esi, eax
call dword [sym.imp.GDI32.dll_SetRectRgn]
mov eax, dword [esp + 0x1c]
push 5
push esi
push esi
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push esi
call ebx
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0047d643
mov eax, dword [ebp + 0x10a18]
mov esi, dword [eax + 0xe220]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x8c]
add esp, 4
push esi
mov esi, dword [eax + 0x70]
mov eax, dword [eax + 0x6c]
push esi
push eax
call edx
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xe0fc]
xor edx, edx
xor esi, esi
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
cmp ecx, edx
je 0x427158
cmp dword [ecx + 8], esi
jne 0x427146
mov ecx, 1
mov dword [eax + 0xe130], ecx
mov dword [eax + 0xe134], ecx
jmp 0x427158
cmp dword [eax + 0xa0], esi
je 0x427158
mov dword [eax + 0x24], 4
mov dword [eax + 0x28], esi
mov eax, dword [ebp + 0x10a18]
mov dword [eax + 0xe0e8], esi
mov ecx, dword [ebp + 0x10a18]
mov dword [ecx + 0xe0f0], esi
mov edx, dword [ebp + 0x10a18]
mov dword [edx + 0xe0ec], esi
mov eax, dword [ebp + 0x10a18]
mov dword [eax + 0xe134], 1
mov ecx, dword [ebp + 0x10a18]
mov dword [ecx + 0xe0b8], esi
mov edx, dword [ebp + 0x10a18]
mov dword [edx + 0xe130], esi
mov eax, dword [ebp + 0x10a18]
mov dword [eax + 0xe138], esi
mov ecx, dword [ebp + 0x10a18]
mov ecx, dword [ecx + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x244]
call eax
test eax, eax
setne al
mov byte [ebp + 0x10a50], al
test al, al
jne 0x4271e8
mov ecx, dword [ebp + 0x10a18]
cmp dword [ecx + 0xe0fc], esi
je 0x4271e8
call fcn.004107d0
cmp byte [ebp + 0x10a50], 0
je 0x42721d
mov edx, dword [ebp + 0x10a18]
cmp dword [edx + 0xe0fc], esi
je 0x427204
call fcn.00410820
cmp byte [ebp + 0x10a50], 0
je 0x42721d
mov ecx, dword [ebp + 0x10a1c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2b8]
call edx
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp + 0x10a58], eax
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdb9c]
push ecx
mov dword [esp + 0xb8], esi
mov dword [esp + 0x4c], esi
mov byte [0x4f373b], 0
mov byte [esp + 0x2b], 1
mov dword [esp + 0x38], esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10a18]
push 0x4a3fbe
add esi, 0xa8
call fcn.0047d6d1
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
add esp, 4
push edx
mov edx, dword [esi]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 8]
push eax
push ecx
push edx
call edi
push 2
mov esi, eax
mov eax, dword [esp + 0x20]
push esi
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push esi
call ebx
mov eax, dword [esp + 0x3c]
push eax
call fcn.0047d643
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xe0fc]
add esp, 4
test ecx, ecx
je 0x4272e8
cmp dword [ecx + 8], 0
jne 0x427377
mov ecx, 1
mov dword [eax + 0xe130], ecx
mov dword [eax + 0xe134], ecx
mov eax, dword [ebp + 0x10a18]
push 1
push 0
lea edx, [esp + 0x24]
push edx
add eax, 4
push eax
call fcn.00412620
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4f378d], 0
mov esi, dword [esp + 0x34]
jne 0x428409
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebp + 0x10a58]
sub ecx, eax
mov dword [ebp + 0x10a54], eax
mov eax, dword [ebp + 0x10a18]
mov edx, dword [eax + 0xe0fc]
add ecx, 0x64
test edx, edx
je 0x42735b
cmp dword [edx + 8], 0
jne 0x427392
mov edx, 1
mov dword [eax + 0xe130], edx
mov dword [eax + 0xe134], edx
mov edx, esi
neg edx
add edx, edx
add edx, edx
sub edx, esi
lea ecx, [ecx + edx*2]
test ecx, ecx
jge 0x427403
xor ecx, ecx
jmp 0x42740d
cmp dword [eax + 0xa0], 0
je 0x4272e8
push 1
push 1
lea ecx, [esp + 0x24]
push ecx
jmp 0x4272f7
cmp dword [eax + 0xa0], 0
je 0x42735b
mov ecx, edx
mov edx, dword [eax + 0xbc]
mov eax, dword [ecx + 4]
xor esi, esi
cmp eax, dword [edx]
jne 0x4273ff
lea esp, [esp]
push 5
call edi
inc esi
cmp esi, 0x14
jg 0x4273ff
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4273e6
mov edx, dword [esp + 0x40]
cmp dword [esp + 0x110], edx
jne 0x4273ff
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x114], eax
jne 0x4273ff
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xbc]
mov edx, dword [eax + 0xe0fc]
mov eax, dword [edx + 4]
cmp eax, dword [ecx]
je 0x4273b0
xor ecx, ecx
jmp 0x42740d
cmp ecx, 0x64
jle 0x42740d
mov ecx, 0x64
mov eax, dword [ebp + 0x10a18]
push ecx
push 0
add eax, 0xdb84
push eax
push 6
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [ebp + 0x10a18]
mov edx, dword [ecx + 0xdb9c]
push 0x2710
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x42744a
mov byte [esp + 0x27], 0
cmp esi, 0x102
ja case.default.0x427465
je case.0x427465.0
cmp esi, 5
ja case.default.0x427465
jmp dword [esi*4 + 0x4286bc]
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdb88]
push ecx
call ebx
mov edx, dword [ebp + 0x10a18]
mov byte [edx + 0xdbac], 1
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdba4]
mov eax, dword [esp + 0x1c]
push 2
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [ebp + 0x10a18]
add eax, 0xdba4
call fcn.00409610
mov edx, dword [ebp + 0x10a18]
inc dword [esp + 0x34]
mov byte [edx + 0xdbac], 0
jmp case.default.0x427465
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdb8c]
push ecx
call ebx
jmp case.default.0x427465
mov eax, dword [ebp + 0x10a4c]
test eax, eax
je 0x42750e
lea edx, [esp + 0x120]
push edx
mov dword [esp + 0x124], 0x14
call eax
mov ecx, dword [esp + 0x128]
mov eax, dword [ebp + 0x10a18]
call fcn.00421bb0
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdb90]
push ecx
call ebx
jmp case.default.0x427465
mov esi, dword [ebp + 0x10a18]
add esi, 0xa8
lea edi, [esp + 0xe0]
call fcn.00409590
mov edx, dword [esp + 0xe0]
mov eax, dword [esp + 0x1c]
push 2
push edx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, edi
call fcn.004095c0
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdb94]
push ecx
call ebx
jmp 0x4283e8
mov edx, dword [ebp + 0x10a18]
mov eax, dword [edx + 0xdb84]
xor esi, esi
push eax
mov dword [esp + 0x38], esi
call ebx
lea ecx, [ebp + 0x10a64]
push ecx
call fcn.00401aa0
mov ecx, dword [ebp + 0x10a1c]
mov word [ebp + 0x10a90], ax
mov edx, dword [ecx]
mov eax, dword [edx + 0xf4]
call eax
movsx ecx, word [ebp + 0x10a90]
cmp ecx, eax
jle 0x4275b7
add dword [ebp + 0x10a94], 0xa
jmp 0x4275be
add dword [ebp + 0x10a94], 0xfffffff6
mov eax, dword [ebp + 0x10a9c]
cmp dword [ebp + 0x10a94], eax
jae 0x4275d2
mov dword [ebp + 0x10a94], eax
mov eax, dword [ebp + 0x10a98]
cmp dword [ebp + 0x10a94], eax
jbe 0x4275e6
mov dword [ebp + 0x10a94], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [ebp + 0x10a58]
mov ecx, dword [ebp + 0x10a94]
mov ebx, eax
sub ebx, edx
mov dword [ebp + 0x10a54], eax
cmp ebx, ecx
jae 0x42760d
sub ecx, eax
add ecx, edx
push ecx
call edi
mov edx, dword [ebp + 0x10a54]
mov eax, dword [ebp + 0x10a18]
mov dword [ebp + 0x10a58], edx
mov ecx, dword [eax + 0xe0fc]
cmp ecx, esi
je 0x42765d
cmp dword [ecx + 8], esi
jne 0x427641
mov ecx, 1
mov dword [eax + 0xe130], ecx
mov dword [eax + 0xe134], ecx
jmp 0x42765d
cmp dword [eax + 0xa0], esi
je 0x42765d
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
call eax
mov ecx, dword [ebp + 0x10a18]
mov dword [ecx + 0xe0bc], esi
mov eax, dword [ebp + 0x10a18]
mov byte [0x4d9d56], 0
cmp dword [eax + 0xe134], esi
je 0x4276cd
cmp dword [eax + 0xe130], esi
jne 0x4276cd
push str.._vncdesktopthread.cpp_:_Hook_changed__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [ebp + 0x10a18]
mov edx, dword [eax + 0xe12c]
add esp, 4
push edx
push eax
call fcn.00422b20
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xe12c], esi
je 0x4276c1
mov dword [eax + 0xe0b0], esi
mov eax, dword [ebp + 0x10a18]
mov dword [eax + 0xe134], esi
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x254]
call eax
test al, al
jne 0x427707
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x50]
push eax
push ebp
lea ecx, [esp + 0xc8]
call fcn.004260c0
test al, al
je 0x428409
xor esi, esi
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x70]
mov byte [esp + 0x17], 0
call eax
test eax, eax
je 0x427992
mov esi, dword [ebp + 0x10a18]
add esi, 0xdc2c
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x1d8], 3
mov eax, dword [ebp + 0x10a18]
lea ebx, [esp + 0x18c]
call fcn.00425300
mov eax, dword [ebp + 0x10a18]
mov edi, dword [eax + 0xe0f8]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [eax + 0xe0f4]
mov edx, dword [edx + 0x88]
push edi
push eax
call edx
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xe0e8], 0
je 0x427853
mov dword [eax + 0xe0e8], 0
mov eax, dword [ebp + 0x10a18]
lea ebx, [esp + 0x1ac]
mov byte [esp + 0x17], 1
call fcn.00425300
mov esi, dword [ebp + 0x10a18]
add esi, 0xa8
lea edi, [esp + 0x108]
call fcn.00409590
mov eax, dword [eax]
push 2
push eax
mov eax, dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ecx, dword [esp + 0x108]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x10c]
push edx
call fcn.0047d643
mov esi, dword [ebp + 0x10a18]
push ecx
add esi, 0xa8
mov edi, esp
mov dword [esp + 0x54], esp
call fcn.00409590
lea ecx, [esp + 0x58]
call fcn.00425490
mov eax, dword [ebp + 0x10a18]
mov esi, dword [eax + 0xe0f8]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [eax + 0xe0f4]
mov edx, dword [edx + 0x88]
push esi
push eax
call edx
mov ebx, dword [ebp + 0x10a18]
add ebx, 4
call fcn.00413560
mov esi, dword [ebp + 0x10a18]
add esi, 4
call fcn.004136a0
mov esi, dword [esp + 0x18]
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xe0ec], 0
je 0x42791e
mov dword [eax + 0xe0ec], 0
mov esi, dword [ebp + 0x10a18]
sub esp, 8
add esi, 0xa8
mov edi, esp
mov dword [esp + 0x54], esp
call fcn.00409590
lea ecx, [esp + 0x58]
call fcn.00425490
mov eax, dword [ebp + 0x10a18]
mov esi, dword [eax + 0xe0f8]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [eax + 0xe0f4]
mov edx, dword [edx + 0x88]
push esi
push eax
call edx
mov esi, dword [ebp + 0x10a18]
add esi, 0xa8
lea edi, [esp + 0xf8]
call fcn.00409590
mov eax, dword [eax]
push 2
push eax
mov eax, dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ecx, dword [esp + 0xf8]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0xfc]
push edx
call fcn.0047d643
mov ebx, dword [ebp + 0x10a18]
add esp, 4
add ebx, 4
call fcn.00413560
mov esi, dword [ebp + 0x10a18]
add esi, 4
call fcn.004136a0
mov esi, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10a1c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x70]
call edx
test eax, eax
je 0x427981
cmp byte [esp + 0x17], 0
je 0x427981
mov eax, dword [ebp + 0x10a18]
mov edi, dword [eax + 0xe0e0]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [eax + 0xe0e4]
mov edx, dword [edx + 0x84]
push 0
push edi
push eax
call edx
mov eax, dword [ebp + 0x10a18]
mov edi, dword [eax + 0xe220]
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x8c]
push edi
mov edi, dword [eax + 0x70]
mov eax, dword [eax + 0x6c]
push edi
push eax
call edx
push esi
mov byte [esp + 0x1dc], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x250]
call eax
mov ecx, dword [ebp + 0x10a18]
mov byte [ecx + 0xa4], al
mov eax, dword [ebp + 0x10a18]
add eax, 0xdc2c
push eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x1d8], 4
mov edx, dword [ebp + 0x10a18]
mov ecx, dword [edx + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
call edx
test eax, eax
je 0x4283c3
lea eax, [esp + 0xf0]
push eax
mov byte [esp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x427a72
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
cmp eax, dword [esp + 0x40]
jne 0x427a1e
cmp ecx, dword [esp + 0x44]
je 0x427a72
mov dword [esp + 0x44], ecx
mov ecx, dword [ebp + 0x10a18]
mov ecx, dword [ecx + 0xdc0c]
mov edx, dword [ecx]
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xa0]
mov byte [esp + 0x17], 1
call eax
mov eax, dword [ebp + 0x10a4c]
cmp eax, esi
je 0x427a72
lea ecx, [esp + 0x120]
push ecx
mov dword [esp + 0x124], 0x14
call eax
mov ecx, dword [esp + 0x128]
mov eax, dword [ebp + 0x10a18]
call fcn.00421bb0
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xa0], esi
je 0x427ad1
cmp byte [eax + 0xe174], 0
je 0x427ad1
mov ecx, dword [eax + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x258]
mov bl, byte [esp + 0x17]
call eax
mov ecx, dword [ebp + 0x10a18]
test bl, bl
je 0x427ab9
neg eax
sbb eax, eax
neg eax
inc eax
add ecx, 4
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], esi
jmp 0x427aef
neg eax
sbb eax, eax
and eax, 2
add eax, 2
add ecx, 4
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], esi
jmp 0x427c01
mov bl, byte [esp + 0x17]
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x20]
push edx
mov al, bl
lea ecx, [esp + 0x50]
mov edi, ebp
call fcn.00426c10
test bl, bl
je 0x427c01
mov esi, dword [ebp + 0x10a18]
cmp dword [esi + 0xa0], 0
jne 0x427c01
lea edi, [esi + 0xdbb0]
mov eax, edi
call fcn.0040a150
test al, al
jne 0x427c01
mov ecx, dword [esi + 0xdbb8]
mov edx, dword [esi + 0xdbbc]
xor eax, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov eax, dword [edi]
sub ecx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xdbb4]
mov dword [esp + 0x30], ecx
mov ecx, dword [esi + 0xdc50]
sub edx, eax
mov dword [esp + 0x2c], edx
mov edx, dword [esi + 0xdc48]
sub ecx, edx
push ecx
mov ecx, dword [esi + 0xdc4c]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0xdc44]
sub ecx, eax
push ecx
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x3c]
lea edi, [esp + 0x40]
call fcn.00425520
add esp, 0x10
test al, al
je 0x427c01
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add edx, eax
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x28]
add ecx, eax
lea esi, [esp + 0x98]
lea edi, [esp + 0xe8]
mov dword [esp + 0xa0], edx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa4], ecx
call fcn.00409590
mov edx, dword [esp + 0xe8]
mov eax, dword [esp + 0x1c]
push 2
push edx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, edi
call fcn.004095c0
mov eax, dword [ebp + 0x10a18]
add eax, 0xdc2c
push eax
mov dword [esp + 0xb4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x1d8], 5
mov eax, dword [ebp + 0x10a18]
xor esi, esi
cmp dword [eax + 0xa0], esi
jne 0x427c53
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
jne 0x427c53
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [ebp + 0x10a18]
call fcn.00421d70
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xe0fc]
cmp ecx, esi
je 0x427c7d
cmp dword [ecx + 8], esi
jne 0x427d00
mov ecx, 1
mov dword [eax + 0xe130], ecx
mov dword [eax + 0xe134], ecx
movzx edx, byte [ebp + 0x10aa4]
mov ecx, dword [ebp + 0x10a18]
push edx
push esi
lea eax, [esp + 0x24]
push eax
add ecx, 4
push ecx
call fcn.00412620
mov edx, dword [ebp + 0x10a18]
mov byte [ebp + 0x10aa4], 1
mov ecx, dword [edx + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x244]
call edx
xor ecx, ecx
cmp byte [ebp + 0x10a50], cl
sete cl
cmp ecx, eax
jne 0x427d29
mov edx, dword [ebp + 0x10a18]
mov ecx, dword [edx + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x244]
call edx
mov ecx, dword [ebp + 0x10a18]
test eax, eax
setne al
mov byte [ebp + 0x10a50], al
cmp dword [ecx + 0xe0fc], esi
je 0x427d29
test al, al
jne 0x427d24
call fcn.004107d0
jmp 0x427d29
cmp dword [eax + 0xa0], esi
je 0x427c7d
movzx edx, byte [ebp + 0x10aa4]
push edx
push 1
lea ecx, [esp + 0x24]
push ecx
add eax, 4
push eax
jmp 0x427c95
call fcn.00410820
mov edx, dword [ebp + 0x10a18]
mov ecx, dword [edx + 0xdc0c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x244]
call edx
test eax, eax
je 0x427ec3
mov eax, dword [ebp + 0x10a18]
cmp byte [eax + 0xa4], 0
jne 0x427ec3
mov ecx, dword [eax + 0xe0ac]
cmp ecx, dword [eax + 0xe0b0]
jne 0x427d76
mov ecx, dword [eax + 0x5c]
mov dword [eax + 0x5c], esi
cmp ecx, esi
je 0x428056
mov eax, dword [ebp + 0x10a18]
mov edx, dword [eax + 0xe0ac]
mov dword [eax + 0xe0b0], edx
mov eax, dword [ebp + 0x10a18]
add eax, 4
mov dword [eax + 0x28], 1
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xa0], esi
jne 0x427dae
lea edi, [eax + 4]
call fcn.004136f0
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xa0]
call eax
mov ecx, dword [ebp + 0x10a18]
mov eax, dword [ecx + 0xdbb0]
mov edx, dword [ecx + 0xdbb8]
sub edx, eax
mov dword [esp + 0x28], edx
mov edx, dword [ecx + 0xdbbc]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0xdbb4]
sub edx, eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov esi, dword [ecx + 0xdc50]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 0xdc48]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0xdc44]
mov ecx, dword [ecx + 0xdc4c]
sub esi, edx
sub ecx, eax
push esi
push ecx
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x38]
push ecx
lea ebx, [esp + 0x28]
lea edi, [esp + 0x38]
call fcn.00425520
add esp, 0x10
test al, al
je 0x427eae
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
add edx, eax
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x30]
add ecx, eax
lea esi, [esp + 0x88]
lea edi, [esp + 0x118]
mov dword [esp + 0x90], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x94], ecx
call fcn.00409590
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x1c]
push 2
push edx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, edi
call fcn.004095c0
mov ecx, dword [ebp + 0x10a1c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2b8]
call edx
jmp 0x428056
mov eax, dword [ebp + 0x10a18]
cmp dword [eax + 0xa0], esi
jne 0x428056
lea edi, [eax + 4]
call fcn.004136f0
cmp byte [esp + 0x17], 0
je 0x428056
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xa0]
call eax
mov esi, dword [ebp + 0x10a18]
lea edi, [esi + 0xdbb0]
mov eax, edi
call fcn.0040a150
test al, al
jne 0x428056
mov edi, dword [edi]
mov ecx, dword [esi + 0xdbb8]
mov edx, dword [esi + 0xdbbc]
xor eax, eax
sub ecx, edi
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov eax, dword [esi + 0xdbb4]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0xdc50]
sub edx, eax
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0xdc48]
sub ecx, edx
push ecx
mov ecx, dword [esi + 0xdc4c]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xdc44]
sub ecx, eax
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], edi
push ecx
lea ebx, [esp + 0x40]
lea edi, [esp + 0x38]
call fcn.00425520
add esp, 0x10
test al, al
je 0x428056
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
add edx, ebx
add ecx, eax
lea esi, [esp + 0x78]
lea edi, [esp + 0x100]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x84], ecx
call fcn.00409590
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0x1c]
push 2
push edx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, edi
call fcn.004095c0
mov eax, dword [ebp + 0x10a18]
mov ecx, dword [eax + 0xdbb4]
mov edx, dword [eax + 0xdbb0]
push ecx
mov ecx, dword [eax + 0xdbbc]
push edx
mov edx, dword [eax + 0xdbb8]
push ecx
push edx
push str.._vncdesktopthread.cpp_:_8__i__i__i__i__n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
add esp, 0x14
push eax
push ebx
push ecx
push edx
push str.._vncdesktopthread.cpp_:_8__i__i__i__i__n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 0x14
push 0x4a3fbe
call fcn.0047d6d1
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esp + 0xbc], eax
call esi
mov ebx, eax
mov dword [esp + 0xa8], ebx
push 0x4a3fbe
call fcn.0047d6d1
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esp + 0x7c], eax
call esi
mov dword [esp + 0x68], eax
push 0x4a3fbe
call fcn.0047d6d1
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esp + 0x84], eax
call esi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x19c]
mov byte [esp + 0x1d8], 8
mov ecx, dword [esp + 0xcc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x4281f1
lea edx, [esp + 0x134]
push edx
call fcn.0041c000
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0xbc]
mov byte [esp + 0x1dc], 9
call fcn.0040ac70
mov ecx, dword [esp + 0x15c]
sub ecx, dword [esp + 0x158]
test ecx, 0xfffffff0
je 0x4281dc
lea esi, [esp + 0x184]
lea edi, [esp + 0x14c]
call fcn.00409b20
mov edx, dword [eax + 4]
mov esi, dword [eax]
mov dword [esp + 0x64], edx
lea ebx, [ebx]
mov eax, dword [esp + 0x15c]
mov edi, eax
cmp dword [esp + 0x158], eax
jbe 0x428167
call fcn.0047d091
test esi, esi
je 0x428174
cmp esi, dword [esp + 0x14c]
je 0x428179
call fcn.0047d091
cmp dword [esp + 0x64], edi
je 0x4281dc
test esi, esi
jne 0x4281d4
call fcn.0047d091
xor eax, eax
mov ecx, dword [esp + 0x64]
cmp ecx, dword [eax + 0x10]
jb 0x428198
call fcn.0047d091
mov edi, dword [ebp + 0x10a18]
mov eax, dword [esp + 0x64]
add edi, 4
lea ecx, [esp + 0x164]
call fcn.00413400
test esi, esi
jne 0x4281d8
call fcn.0047d091
xor eax, eax
mov edx, dword [esp + 0x64]
cmp edx, dword [eax + 0x10]
jb 0x4281ca
call fcn.0047d091
add dword [esp + 0x64], 0x10
jmp 0x428150
mov eax, dword [esi]
jmp 0x42818a
mov eax, dword [esi]
jmp 0x4281bc
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0x1dc], 8
call fcn.0041c070
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x20]
push edx
lea esi, [esp + 0x40]
call fcn.004096d0
mov esi, dword [sym.imp.GDI32.dll_SetRectRgn]
push 0
push 0
push 0
push 0
push ebx
mov edi, eax
call esi
mov eax, dword [edi]
push 5
push eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [esp + 0x38]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call edi
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0047d643
mov edx, dword [esp + 0x20]
add esp, 4
push 0
push 0
push 0
push 0
push edx
call esi
mov eax, dword [esp + 0xcc]
push 5
push eax
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
lea ecx, [esp + 0x1bc]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
cmp eax, 1
je 0x42829b
lea edx, [esp + 0xa8]
push edx
mov edx, dword [ebp + 0x10a18]
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x70]
push ecx
add edx, 4
push edx
call fcn.00412b30
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x54]
call fcn.0040a230
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x54]
call fcn.0040a2b0
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x9c]
call eax
push eax
lea ecx, [esp + 0xbc]
call fcn.0040ae10
mov ecx, dword [esp + 0x70]
push ecx
call edi
mov edx, dword [esp + 0x74]
push edx
call fcn.0047d643
mov eax, dword [esp + 0x6c]
add esp, 4
push eax
call edi
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0047d643
add esp, 4
push ebx
call edi
mov edx, dword [esp + 0xac]
push edx
call fcn.0047d643
mov byte [esp + 0x1dc], 4
mov eax, dword [esp + 0xb4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xbc]
push 0
push 0
push 0
push 0
push ecx
call esi
mov edx, dword [esp + 0xcc]
push 0
push 0
push 0
push 0
push edx
call esi
mov eax, dword [esp + 0xc4]
push 0
push 0
push 0
push 0
push eax
call esi
mov ecx, dword [ebp + 0x10a18]
cmp dword [ecx + 0xe120], 0
je 0x4283c3
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2b0]
call eax
test eax, eax
je 0x42838d
mov ecx, dword [ebp + 0x10a18]
call fcn.00422420
test eax, eax
je 0x4283c3
cmp dword [0x4bb5d4], 2
je 0x4283c3
push 0
push 0
push 1
push 0x56
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp + 0x10a18]
mov edx, dword [ecx + 0xdc14]
push 2
push 0xf170
push 0x112
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp + 0x10a54], eax
mov byte [esp + 0x1d8], 2
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x27], 0
je 0x428409
jmp 0x42730c
mov ecx, dword [ebp + 0x10a18]
mov edx, dword [ecx + 0xdb98]
push edx
call ebx
mov esi, dword [esp + 0x48]
mov byte [0x4f373b], 1
test esi, esi
je 0x42842b
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10a18]
mov dword [eax + 0xdc1c], 0
push str.._vncdesktopthread.cpp_:_quitting_desktop_server_thread_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov edi, dword [ebp + 0x10a18]
mov ecx, dword [edi + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1fc]
add esp, 4
call eax
test eax, eax
je 0x428511
mov ecx, dword [edi + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x204]
call eax
test eax, eax
jne 0x42848d
xor al, al
mov esi, edi
call fcn.004220f0
push str.enabled
push str.._vncdesktop.cpp_:_SetDisableInput:_inputs__s_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [0x4bb5d4]
add esp, 8
cmp eax, 1
je 0x4284d6
cmp eax, 2
je 0x4284d6
mov ecx, dword [edi + 0xdc0c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x134]
push 0
call eax
mov dword [edi + 0xe12c], 1
jmp 0x4284fd
mov eax, dword [edi + 0xe160]
test eax, eax
je 0x4284fd
push 0
call eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0xe160]
test eax, eax
je 0x4284fd
push 0
call eax
mov esi, dword [edi + 0xdc0c]
push 1
call fcn.00450910
mov byte [edi + 0xe22c], 0
mov esi, dword [edi + 0xdc0c]
xor ecx, ecx
cmp byte [edi + 0xe22c], cl
sete cl
push ecx
call fcn.00450910
mov ecx, dword [ebp + 0x10a1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x74]
push 0
call eax
push str.._vncdesktopthread.cpp_:_quitting_desktop_server_thread:SetBlockInputState_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
cmp dword [0x4ee094], 2
jne 0x42857e
mov bl, 0xa0
call fcn.0043ba90
mov bl, 0xa2
call fcn.0043ba90
mov bl, 0xa4
call fcn.0043ba90
mov bl, 0xa1
call fcn.0043ba90
mov bl, 0xa3
call fcn.0043ba90
mov bl, 0xa5
jmp 0x42858e
mov bl, 0x10
call fcn.0043ba90
mov bl, 0x11
call fcn.0043ba90
mov bl, 0x12
call fcn.0043ba90
push str.._vncdesktopthread.cpp_:_quitting_desktop_server_thread:ClearShiftKeys_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
push 0
push str.blackscreen
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4285c8
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.._vncdesktopthread.cpp_:_quitting_desktop_server_thread:g_DesktopThread_runningfalse_n
mov ecx, 9
mov eax, 0x4bc990
mov byte [0x4d9d55], 0
call fcn.00401110
mov edi, dword [ebp + 0x10a18]
add esp, 4
call fcn.004201c0
push str.._vncdesktopthread.cpp_:_quitting_desktop_server_thread:m_desktop__Shutdown_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
add esp, 4
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call fcn.0047d643
mov eax, dword [esp + 0x5c]
add esp, 4
push eax
mov dword [esp + 0x54], vtable.rfb::ClippedUpdateTracker.0
call esi
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0047d643
mov edx, dword [esp + 0xd0]
add esp, 4
push edx
mov dword [esp + 0x54], vtable.rfb::UpdateTracker.0
mov dword [esp + 0xbc], vtable.rfb::SimpleUpdateTracker.0
call esi
mov eax, dword [esp + 0xd0]
push eax
call fcn.0047d643
mov ecx, dword [esp + 0xc8]
add esp, 4
push ecx
call esi
mov edx, dword [esp + 0xc8]
push edx
call fcn.0047d643
mov eax, dword [esp + 0xc0]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.0047d643
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4