Function at 0x44abd0
Capabilities:
Create process on windows
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x489348]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
call fcn.0043b860
push 0
call fcn.0045e8de
add eax, 0x40
push eax
call fcn.0045fbf4
add esp, 8
push str.vnclang_server.dll
mov dword [0x4a1094], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4a1094], eax
test eax, eax
jne 0x44ac37
mov dword [0x4a1094], esi
call fcn.0044a6d0
push 0x104
lea eax, [esp + 0x194]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x44ac72
lea ecx, [esp + 0x190]
push 0x5c
push ecx
call fcn.0045cab0
add esp, 8
test eax, eax
je 0x44b1cf
mov byte [eax], 0
lea edi, [esp + 0x190]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x44ac80
mov dx, word [0x47533c]
lea eax, [esp + 0x190]
mov word [edi], dx
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44aca0
mov ecx, dword [str.WinVNC.log]
mov edx, dword [0x481d3c]
mov dword [eax], ecx
mov cx, word [0x481d40]
mov dword [eax + 4], edx
mov dl, byte [0x481d42]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, dword [0x48b408]
test eax, eax
je 0x44acdf
push eax
call fcn.0045d511
add esp, 4
lea eax, [esp + 0x190]
push eax
call fcn.0045dae4
add esp, 4
cmp byte [0x48b3f8], 0
mov dword [0x48b408], eax
mov byte [0x48b40c], 1
je 0x44ad09
call fcn.004372b0
mov ecx, esi
mov dword [0x4a5458], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea esi, [esp + 0x14]
mov dword [0x4a5a64], eax
call fcn.00449b40
xor edi, edi
cmp dword [esp + 0x14], edi
jne 0x44ad44
push edi
push str.WinVNC
push 0x4a64d0
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44b1cf
mov eax, ebx
xor esi, esi
lea edx, [eax + 1]
jmp 0x44ad50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ad50
sub eax, edx
je 0x44ad83
jmp 0x44ad60
movsx edx, byte [ebx + esi]
push edx
call fcn.0045e217
mov byte [ebx + esi], al
mov eax, ebx
add esp, 4
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ad76
sub eax, edx
cmp esi, eax
jb 0x44ad60
mov eax, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ad90
sub eax, edx
je 0x44b1b8
mov edi, dword [esp + 0xc]
cmp byte [ebx + edi], 0x20
lea esi, [ebx + edi]
jle 0x44b18e
push 0xf
push str._settingshelper
push esi
mov dword [esp + 0x20], 1
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b1e8
push 0x12
push str._stopservicehelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b20d
push 5
push str._kill
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b214
push 0x13
push str._startservicehelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b279
push 0xe
push str._installhelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b283
push 0x10
push str._uninstallhelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b28d
push 0x15
push str._securityeditorhelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b297
push 0xf
push str._securityeditorhelper
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b2a1
push 9
push 0x4790b0
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b350
push 0xc
push 0x4790d0
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b37b
push 0xd
push 0x4790f4
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b385
push 8
push 0x479104
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b38f
push 0xa
push 0x479110
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b40a
push 0xc
push str._service_run
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b46f
push 8
push str._service
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b4b5
push 4
push 0x479078
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
je 0x44b4c1
push 0xe
push str._autoreconnect
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
jne 0x44b02f
mov esi, dword [esp + 0xc]
mov al, byte [ebx + esi + 0xe]
add esi, 0xe
xor edi, edi
cmp al, 0x20
mov dword [esp + 0xc], esi
jg 0x44af72
test al, al
je 0x44af72
mov al, byte [ebx + esi + 1]
inc esi
cmp al, 0x20
jle 0x44af65
push 3
lea eax, [ebx + esi]
push 0x47909c
push eax
mov dword [esp + 0x1c], eax
call fcn.0045df4e
add esp, 0xc
test eax, eax
jne 0x44afe5
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0x20
mov eax, esi
jle 0x44af9f
inc eax
cmp byte [ebx + eax], 0x20
jg 0x44af98
mov ebx, eax
sub ebx, esi
lea edx, [ebx + 1]
push edx
call fcn.0045cadd
mov edi, eax
add esp, 4
test edi, edi
je 0x44afd3
mov eax, dword [esp + 0x10]
push ebx
push eax
push edi
call fcn.0045d9c0
add esp, 0xc
push edi
mov byte [ebx + edi], 0
call fcn.0045d88b
add esp, 4
mov edi, eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44afd8
sub eax, edx
add dword [esp + 0xc], eax
mov eax, edi
call fcn.00448710
test eax, eax
jne 0x44b18e
mov byte [0x4a66fb], 1
test edi, edi
jne 0x44b012
mov byte [0x4a6733], 1
mov byte [0x4a66fb], 0
jmp 0x44b18e
mov edx, 0x4a6510
mov eax, edi
sub edx, edi
jmp 0x44b020
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x44b020
jmp 0x44b18e
push 8
push str._connect
push esi
call fcn.0045df4e
add esp, 0xc
test eax, eax
jne 0x44b4f8
mov edi, dword [esp + 0xc]
mov al, byte [ebx + edi + 8]
add edi, 8
cmp al, 0x20
mov dword [esp + 0xc], edi
jg 0x44b06d
lea ebx, [ebx]
test al, al
je 0x44b06d
mov al, byte [ebx + edi + 1]
inc edi
cmp al, 0x20
jle 0x44b060
cmp byte [ebx + edi], 0x20
mov eax, edi
mov dword [esp + 0x10], edi
jle 0x44b08b
lea esp, [esp]
inc eax
cmp byte [ebx + eax], 0x20
jg 0x44b080
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
sub ebx, edi
test ebx, ebx
jle 0x44b16d
lea ecx, [ebx + 1]
push ecx
call fcn.0045cadd
mov esi, eax
add esp, 4
test esi, esi
je 0x44b163
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [edx + edi]
push eax
push esi
call fcn.0045d9c0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, esi
sub eax, edi
push 0x3a
push esi
mov byte [eax + ecx], 0
mov edi, 0x157c
call fcn.0045e7e0
add esp, 8
test eax, eax
je 0x44b0f6
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x44b0eb
inc eax
push eax
call fcn.0045e024
mov edi, eax
add esp, 4
push edi
push esi
push str..winvnc.cpp_:_test...__s__d_n
xor ecx, ecx
mov eax, 0x48b3f0
call fcn.00401000
add esp, 0xc
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x44b133
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x44b12b
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
jne 0x44b12f
xor ebx, ebx
jmp 0x44b135
mov edx, dword [eax]
mov eax, dword [edx]
mov ebx, eax
push esi
call fcn.0045d506
add esp, 4
test ebx, ebx
je 0x44b163
push edi
push ebx
call fcn.004486d0
add esp, 8
test eax, eax
jne 0x44b163
mov byte [0x4a6732], 1
mov dword [0x4a5a60], edi
mov dword [0x4a56e0], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
jmp 0x44b18e
push 0
push 0
call fcn.004486d0
add esp, 8
test eax, eax
jne 0x44b18e
mov byte [0x4a6732], 1
mov dword [0x4a5a60], eax
mov dword [0x4a56e0], eax
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x1c]
inc edi
mov eax, ebx
mov dword [esp + 0xc], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b1a0
sub eax, edx
cmp edi, eax
jb 0x44ada3
cmp dword [esp + 0x14], 0
jne 0x44b1c9
mov ecx, dword [esp + 0x18]
call fcn.0044aa50
test al, al
jne 0x44b48f
call dword [sym.imp.WSOCK32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 0x10
lea ebx, [ebx + edi + 0x10]
lea ecx, [esp + 0x88]
sub ecx, ebx
mov al, byte [ebx]
mov byte [ebx + ecx], al
inc ebx
test al, al
jne 0x44b1f5
lea ecx, [esp + 0x88]
call fcn.00402ab0
jmp 0x44b1c9
call fcn.00403c80
jmp 0x44b1c9
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x4a6fec], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x4a6fec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x44b1c9
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push esi
call edi
push 0
push 0
push 0x10
push esi
call edi
jmp 0x44b1c9
call fcn.00403d90
jmp 0x44b1c9
call fcn.00403eb0
jmp 0x44b1c9
call fcn.00403f40
jmp 0x44b1c9
call fcn.00403fd0
jmp 0x44b1c9
push 0x104
lea edx, [esp + 0x8c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x44b302
lea eax, [esp + 0x88]
push 0x5c
push eax
call fcn.0045cab0
mov byte [eax], 0
lea eax, [esp + 0x90]
add esp, 8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44b2d7
mov ecx, dword [str._authSSP.dll]
mov edx, dword [0x47fb04]
mov dword [eax], ecx
mov ecx, dword [0x47fb08]
mov dword [eax + 4], edx
mov dl, byte [0x47fb0c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x44b1c9
push str.vncEditSecurity
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x4a5458]
push ecx
push 0
call edi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44b1c9
lea ebx, [ebx + edi + 0xa]
lea ecx, [esp + 0x88]
sub ecx, ebx
lea ecx, [ecx]
mov al, byte [ebx]
mov byte [ebx + ecx], al
inc ebx
test al, al
jne 0x44b360
lea ecx, [esp + 0x88]
call fcn.00402bb0
jmp 0x44b1c9
call fcn.00403d10
jmp 0x44b1c9
call fcn.00403e20
jmp 0x44b1c9
call fcn.00408ff0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [str.net_start]
mov eax, dword [0x47a350]
mov cx, word [0x47a354]
mov dword [esp + 0x20], edx
mov dl, byte [0x47a356]
mov dword [esp + 0x24], eax
mov eax, str.uvnc_service
mov byte [esp + 0x2a], dl
mov word [esp + 0x28], cx
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b3d0
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44b3e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x44b1c9
mov ax, word [0x47a348]
mov edx, dword [0x47a344]
mov ecx, dword [str.net_stop]
mov word [esp + 0x28], ax
mov eax, str.uvnc_service
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b430
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44b440
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.004090d0
jmp 0x44b1c9
mov ecx, dword [esp + 0x18]
call fcn.0044aa50
test al, al
je 0x44b1c9
mov eax, 1
mov dword [0x4a6734], eax
mov dword [0x4a6728], eax
call fcn.0044b8c0
mov esi, eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 0x10
mov eax, ebx
call fcn.00408ee0
jmp 0x44b1c9
mov ecx, dword [esp + 0x18]
call fcn.0044aa50
test al, al
je 0x44b1c9
call fcn.0044b8c0
mov esi, eax
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [esp + 0x29c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0045c77f
mov esp, ebp
pop ebp
ret 0x10
push 0x40
push 0x4a6170
push str.winvnc___run____autoreconnect__ID:_________connect_host_:display_____connect_host_::port____n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44b1c9