Function at 0x486fa0
Capabilities:
Check os version
Create process on windows
Delete registry value
Rebuild import table
Resolve function by parsing pe exports
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdbc
mov eax, dword [0x55800c]
xor eax, esp
mov dword [esp + 0xdb8], eax
cmp byte [0x559370], 1
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x24], eax
jne 0x486fe4
push 0x10
push str.Warning
mov edx, str.WIndows_XP_require_special_build
call fcn.00425e00
add esp, 8
cmp byte [0x559374], 1
jne 0x48701d
push 0x10
push str.Unsupported_OS
mov edx, str.Error_OS_not_supported
call fcn.00425e00
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdb8]
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x487054
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48704d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 2
mov byte [esp + 0x27], 0
mov dword [0x567970], 0
mov dword [0x56769c], 0
call fcn.004db37d
add esp, 4
push eax
call fcn.004dc686
add esp, 8
mov dword [0x567d1c], 0
lea eax, [esp + 0x790]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4870ba
lea eax, [esp + 0x790]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
mov byte [eax], 0
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x790]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x57f], al
test al, al
jne 0x4870c0
lea edi, [esp + 0x580]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4870e0
mov ax, word [0x53e1f8]
lea ecx, [esp + 0x580]
mov word [edi], ax
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x487100
mov eax, dword [str.vnclang_server.dll]
mov dword [ecx], eax
mov eax, dword [0x54caac]
mov dword [ecx + 4], eax
mov eax, dword [0x54cab0]
mov dword [ecx + 8], eax
mov eax, dword [0x54cab4]
mov dword [ecx + 0xc], eax
mov ax, word [0x54cab8]
mov word [ecx + 0x10], ax
mov al, byte [0x54caba]
mov byte [ecx + 0x12], al
lea eax, [esp + 0x580]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [esp + 0x24]
test eax, eax
cmove eax, esi
mov dword [0x567d1c], eax
call fcn.004868c0
push 0x104
lea eax, [esp + 0x89c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x487192
lea eax, [esp + 0x898]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x487dee
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x89c]
push eax
lea eax, [esp + 0x9a8]
push eax
call fcn.004daa40
add esp, 0xc
mov byte [esp + 0xaa3], 0
call fcn.004710d0
mov dword [0x568a68], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x28]
call fcn.00485940
cmp dword [esp + 0x28], 0
jne 0x4871f1
push 0
push 0x542d04
mov edx, 0x568620
call fcn.00425e00
add esp, 8
jmp 0x487dee
lea ecx, [esp + 0x9a0]
call fcn.00425b60
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487204
sub ecx, edx
je 0x487233
nop
movsx eax, byte [ebx + esi]
push eax
call fcn.004da9df
mov ecx, ebx
mov byte [ebx + esi], al
add esp, 4
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487226
sub ecx, edx
cmp esi, ecx
jb 0x487210
mov ecx, ebx
xor eax, eax
mov dword [esp + 0x28], eax
xor edi, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487240
sub ecx, edx
je 0x487aec
nop
cmp byte [ebx + edi], 0x20
lea esi, [ebx + edi]
jle 0x487ac5
push 8
push str._inifile
push esi
mov dword [esp + 0x34], 1
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x487326
lea eax, [esp + 0xaa8]
add edi, 8
push eax
lea eax, [esp + 0xbb4]
push eax
lea eax, [esp + 0xcc0]
push eax
lea eax, [esp + 0x694]
push eax
lea eax, [ebx + 1]
add eax, edi
push eax
call fcn.004dc8d5
add esp, 0x14
lea eax, [esp + 0xaa8]
push 0x20
push eax
call fcn.004cd700
add esp, 8
test eax, eax
je 0x4872c7
mov byte [eax], 0
lea eax, [esp + 0xaa8]
push eax
lea eax, [esp + 0xbb4]
push eax
lea eax, [esp + 0xcc0]
push eax
lea eax, [esp + 0x694]
push eax
lea eax, [esp + 0x488]
push eax
call fcn.004dca8a
add esp, 0x14
lea eax, [esp + 0x478]
push eax
call fcn.004dad37
lea ecx, [esp + 0x47c]
mov dword [0x55aba8], eax
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487316
sub ecx, edx
add edi, ecx
jmp 0x487ac5
push 0xf
push str._settingshelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4882fc
push 0x12
push str._stopservicehelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4882e7
push 5
push str._kill
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x48827a
push 0xd
push str._openhomepage
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x48825d
push 0xa
push str._openforum
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x488240
push 0x13
push str._startservicehelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x48822b
push 0xe
push str._installhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x488216
push 0x10
push str._uninstallhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x488201
push 0x12
push str._softwarecadhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4881ec
push 0x15
push str._delsoftwarecadhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4881d7
push 0x15
push str._rebootsafemodehelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4881c2
push 0x12
push str._rebootforcehelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4881ad
push 0x15
push str._securityeditorhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x488198
push 0xf
push str._securityeditor
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4880f5
push 9
push str._settings
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x4880d1
push 0x10
push str._dsmpluginhelper
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x488012
push 0x12
push str._dsmplugininstance
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487fee
push 0xc
push 0x519f94
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487f6a
push 0xf
push 0x519f30
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487ef2
push 0xf
push 0x519eb0
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487e0b
push 0xc
push 0x519fc8
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487d6c
push 0xc
push str._stopservice
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487d60
push 0xd
push str._startservice
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487d2f
push 8
push str._install
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487c89
push 0xa
push str._uninstall
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487bbe
push 0xb
push 0x519ee4
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x4875a1
add edi, 0xb
mov byte [0x55b152], 1
jmp 0x487ac5
push 0xc
push str._service_run
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487b73
push 8
push str._service
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487b67
push 4
push 0x519fa4
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
je 0x487aec
push 8
push str._sc_exit
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x48760f
mov dword [0x567970], 1
add edi, 8
jmp 0x487ac5
push 0xa
push str._sc_prompt
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x487635
mov dword [0x56769c], 1
add edi, 0xa
jmp 0x487ac5
push 6
push str._multi
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x48765b
mov dword [0x5689a4], 1
add edi, 6
jmp 0x487ac5
push 0xe
push str._stopreconnect
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x48769a
mov ecx, dword [0x569bf4]
xor edx, edx
push eax
add edi, 0xe
call fcn.00484510
mov ecx, dword [0x569c00]
add esp, 4
xor edx, edx
push 0
call fcn.00484510
add esp, 4
jmp 0x487ac5
push 0xe
push str._autoreconnect
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x487799
add edi, 0xe
mov dword [esp + 0x18], eax
mov byte [esp + 0x1f], 1
mov esi, edi
mov al, byte [ebx + edi]
cmp al, 0x20
jg 0x4876d4
test al, al
je 0x4876d4
mov al, byte [ebx + esi + 1]
inc esi
cmp al, 0x20
jle 0x4876c7
push 3
lea eax, [ebx + esi]
push 0x519cf0
push eax
mov dword [esp + 0x2c], eax
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x48773a
cmp byte [ebx + esi], 0x20
mov edi, esi
jle 0x4876fe
inc edi
cmp byte [ebx + edi], 0x20
jg 0x4876f7
mov eax, edi
sub eax, esi
mov dword [esp + 0x10], eax
je 0x48773a
inc eax
push eax
call fcn.004cbf7b
add esp, 4
mov esi, eax
push dword [esp + 0x10]
push dword [esp + 0x24]
push esi
call fcn.004daa40
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
mov byte [eax + esi], 0
call fcn.004db21f
add esp, 4
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.00484b80
test eax, eax
jne 0x487783
mov byte [0x563187], 1
test esi, esi
jne 0x487765
mov byte [0x56328b], 1
mov byte [0x563187], al
jmp 0x487ac5
push esi
push 0x14
push 0x567ee8
call fcn.004d0170
add esp, 0xc
push esi
call fcn.004cbf38
add esp, 4
jmp 0x487ac5
test esi, esi
je 0x487ac5
push esi
call fcn.004cbf38
add esp, 4
jmp 0x487ac5
push 4
push str._id:
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x487839
lea ecx, [edi + 1]
xor esi, esi
cmp byte [ebx + ecx], 0x20
lea eax, [ebx + ecx]
mov edi, ecx
mov dword [esp + 0x20], eax
jle 0x4877cc
inc edi
cmp byte [ebx + edi], 0x20
jg 0x4877c5
mov eax, edi
sub eax, ecx
mov dword [esp + 0x10], eax
je 0x48780a
inc eax
push eax
call fcn.004cbf7b
mov esi, eax
add esp, 4
test esi, esi
je 0x48780a
push dword [esp + 0x10]
push dword [esp + 0x24]
push esi
call fcn.004daa40
mov eax, dword [esp + 0x1c]
add esp, 0xc
push esi
mov byte [eax + esi], 0
call fcn.004db21f
add esp, 4
mov esi, eax
mov ecx, esi
call fcn.00484bb0
test eax, eax
jne 0x487783
mov byte [0x5674c7], 1
test esi, esi
jne 0x487765
mov byte [0x5674c6], 1
mov byte [0x5674c7], al
jmp 0x487ac5
push 8
push str._connect
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x4879e9
cmp byte [esp + 0x1f], al
jne 0x487868
mov ecx, dword [0x569bf4]
xor edx, edx
push eax
call fcn.00484510
add esp, 4
mov al, byte [ebx + edi + 8]
add edi, 8
mov esi, edi
cmp al, 0x20
jg 0x487882
test al, al
je 0x487882
mov al, byte [ebx + esi + 1]
inc esi
cmp al, 0x20
jle 0x487875
cmp byte [ebx + esi], 0x20
lea ecx, [ebx + esi]
mov eax, esi
mov dword [esp + 0x10], esi
jle 0x48789c
inc eax
cmp byte [ebx + eax], 0x20
jg 0x487891
mov dword [esp + 0x10], eax
sub eax, esi
mov dword [esp + 0x20], eax
je 0x4879ae
inc eax
push eax
call fcn.004cbf7b
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
je 0x4879a5
push dword [esp + 0x20]
lea eax, [ebx + esi]
push eax
push edi
call fcn.004daa40
add esp, 0xc
mov ecx, edi
mov edi, dword [esp + 0x10]
sub ecx, esi
mov esi, 0x157c
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x14]
push 0x3a
push esi
mov byte [ecx + edi], 0
call fcn.004cd700
add esp, 8
test eax, eax
je 0x487912
mov byte [eax], 0
inc eax
cmp byte [eax], 0x3a
jne 0x487903
inc eax
push eax
call fcn.004d58de
add esp, 4
mov dword [esp + 0x18], eax
jmp 0x487917
mov eax, 0x157c
push eax
push esi
push str.d:_saasultravncwinvncwinvncwinvnc.cpp_:_test...__s__d_n
push 0
push 0x558c50
call fcn.0041c840
add esp, 0x14
push esi
push 0xff
push 0x568a70
call fcn.004d0170
add esp, 0xc
mov ecx, esi
call fcn.00485db0
push esi
mov dword [esp + 0x14], eax
call fcn.004cbf38
add esp, 4
cmp dword [esp + 0x10], 0
je 0x487b23
push str.d:_saasultravncwinvncwinvncwinvnc.cpp_:_PostAddNewClient_III__n
push 0
push 0x558c50
call fcn.0041c840
mov esi, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, esi
call fcn.00484af0
test eax, eax
jne 0x487ac5
mov eax, dword [esp + 0x10]
mov byte [0x563289], 1
mov dword [0x567ac4], esi
mov dword [0x567d18], eax
jmp 0x487ac5
mov edi, dword [esp + 0x10]
jmp 0x487ac5
push str.d:_saasultravncwinvncwinvncwinvnc.cpp_:_PostAddNewClient_IIII_n
push 0
push 0x558c50
call fcn.0041c840
add esp, 0xc
xor edx, edx
xor ecx, ecx
call fcn.00484a80
test eax, eax
jne 0x487ac5
mov byte [0x563289], 1
mov dword [0x567ac4], eax
mov dword [0x567d18], eax
jmp 0x487ac5
push 9
push str._repeater
push esi
call fcn.004d5610
add esp, 0xc
test eax, eax
jne 0x487b4e
mov cl, byte [ebx + edi + 9]
add edi, 9
mov eax, edi
cmp cl, 0x20
jg 0x487a1e
nop
test cl, cl
je 0x487a1e
mov cl, byte [ebx + eax + 1]
inc eax
cmp cl, 0x20
jle 0x487a10
cmp byte [ebx + eax], 0x20
lea ecx, [ebx + eax]
mov esi, eax
mov dword [esp + 0x14], ecx
jle 0x487a37
nop dword [eax]
inc esi
cmp byte [ebx + esi], 0x20
jg 0x487a30
mov ecx, esi
sub ecx, eax
mov dword [esp + 0x10], ecx
je 0x487ac5
mov eax, dword [0x567ac0]
test eax, eax
je 0x487a65
push eax
call fcn.004cbf38
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [0x567ac0], 0
lea eax, [ecx + 1]
push eax
call fcn.004cbf7b
add esp, 4
mov dword [0x567ac0], eax
test eax, eax
je 0x487ac3
mov edi, dword [esp + 0x10]
push edi
push dword [esp + 0x18]
push eax
call fcn.004daa40
mov eax, dword [0x567ac0]
add esp, 0xc
push str.d:_saasultravncwinvncwinvncwinvnc.cpp_:_PostAddNewRepeaterClient_I_n
push 0
push 0x558c50
mov byte [edi + eax], 0
call fcn.0041c840
add esp, 0xc
call fcn.00484b60
test eax, eax
jne 0x487ac3
mov byte [0x56328a], 1
mov dword [0x567ac4], eax
mov dword [0x567d18], eax
mov edi, esi
mov ecx, ebx
inc edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x487ad0
sub ecx, edx
cmp edi, ecx
jb 0x487250
cmp dword [esp + 0x28], 0
jne 0x487de8
mov ecx, dword [esp + 0x24]
call fcn.00486c40
test al, al
je 0x487de8
call fcn.00488740
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdb8]
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 0x10
push 0x7d0
mov byte [0x563289], 1
mov dword [0x567ac4], 0
mov dword [0x567d18], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x487de8
push 0x40
push 0x568360
mov edx, str.winvnc___sc_prompt____sc_exit____id:________stopreconnect___autoreconnect__ID:_________connect_host_:display_____connect_host_::port_____repeater_host_:port_____inifile_________run__n
call fcn.00425e00
add esp, 8
jmp 0x487de8
mov ecx, ebx
call fcn.0042bcb0
jmp 0x487de8
mov ecx, dword [esp + 0x24]
call fcn.00486c40
test al, al
je 0x487de8
mov dword [0x567efc], 1
mov dword [0x5674b8], 1
call fcn.00488740
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdb8]
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [esi]
test al, al
je 0x487bfc
movzx eax, al
push eax
call fcn.004dcc53
add esp, 4
test eax, eax
jne 0x487bde
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x487bc4
jmp 0x487bfc
mov al, byte [esi]
test al, al
je 0x487bfc
movzx eax, al
push eax
call fcn.004dcc53
add esp, 4
test eax, eax
je 0x487bfc
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x487be4
mov al, byte [esi]
mov cl, al
test al, al
je 0x487c0c
cmp al, 0x22
jne 0x487c0c
mov cl, byte [esi + 1]
inc esi
test cl, cl
je 0x487c22
push 0x22
push esi
call fcn.004cd350
add esp, 8
test eax, eax
je 0x487c22
mov byte [eax], 0
cmp byte [esi], 0
je 0x487c53
push str.uvnc_service
push esi
call fcn.004dadd3
add esp, 8
test eax, eax
je 0x487c53
push 0x100
push esi
push str.uvnc_service
call fcn.004daa40
add esp, 0xc
mov byte [0x558a9f], 0
push str.uvnc_service
push str.net_stop___s_
lea eax, [esp + 0x80]
push 0x124
push eax
call fcn.004241d0
add esp, 0x10
lea eax, [esp + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.0042bf80
jmp 0x487de8
mov al, byte [esi]
test al, al
je 0x487cc8
nop
movzx eax, al
push eax
call fcn.004dcc53
add esp, 4
test eax, eax
jne 0x487caa
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x487c90
jmp 0x487cc8
mov al, byte [esi]
test al, al
je 0x487cc8
movzx eax, al
push eax
call fcn.004dcc53
add esp, 4
test eax, eax
je 0x487cc8
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x487cb0
mov al, byte [esi]
mov cl, al
test al, al
je 0x487cd8
cmp al, 0x22
jne 0x487cd8
mov cl, byte [esi + 1]
inc esi
test cl, cl
je 0x487cee
push 0x22
push esi
call fcn.004cd350
add esp, 8
test eax, eax
je 0x487cee
mov byte [eax], 0
cmp byte [esi], 0
je 0x487d1f
push str.uvnc_service
push esi
call fcn.004dadd3
add esp, 8
test eax, eax
je 0x487d1f
push 0x100
push esi
push str.uvnc_service
call fcn.004daa40
add esp, 0xc
mov byte [0x558a9f], 0
call fcn.0042bd00
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uvnc_service
push str.net_start___s_
lea eax, [esp + 0x80]
push 0x124
push eax
call fcn.004241d0
add esp, 0x10
lea eax, [esp + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x487de8
push str.uvnc_service
push str.net_stop___s_
jmp 0x487d39
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x487de8
lea eax, [esp + 0x6c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x74]
mov dword [esp + 0x74], 1
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x8c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x487de8
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x7c], 6
push 0
jae 0x487e07
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0xdc4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 0x10
push 6
jmp 0x487de2
push str.uvnc_service
push str.Network
push str.SYSTEMCurrentControlSetControlSafeBoot_s_s
lea eax, [esp + 0x84]
mov dword [esp + 0x20], 0
push 0x400
push eax
call fcn.004241d0
add esp, 0x14
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x94]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487de8
push 8
push str.Service
push 1
push eax
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042c130
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x487de8
lea eax, [esp + 0x6c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x74]
mov dword [esp + 0x74], 1
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x8c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x487de8
push 0
push 2
jmp 0x487de2
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487de8
lea eax, [esp + 0x18]
push eax
push 0x2001f
push 0
push str.System
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487fb8
push str.SoftwareSASGeneration
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x10]
call esi
jmp 0x487de8
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x487de8
lea eax, [esp + 0x18]
push eax
push 0x2001f
push 0
push str.System
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x487fc7
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x487de8
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
push 4
push 0
push str.SoftwareSASGeneration
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x487f53
lea eax, [esi + 0x13]
push eax
lea eax, [esp + 0x7c]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea ecx, [esp + 0x78]
call fcn.0047b040
jmp 0x487de8
lea eax, [esi + 0x11]
push eax
lea eax, [esp + 0x7c]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea eax, [esp + 0x478]
push str.__dsmplugininstance
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x47c]
push 0x104
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [esp + 0x688]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x2c], 0x3c
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x688]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x478]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x3c], str.runas
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x487de8
lea eax, [esi + 0xa]
push eax
lea eax, [esp + 0x7c]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea ecx, [esp + 0x78]
call fcn.004242e0
jmp 0x487de8
push 0x104
lea eax, [esp + 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48814e
lea eax, [esp + 0x78]
push 0x5c
push eax
call fcn.004cd350
lea ecx, [esp + 0x80]
add esp, 8
dec ecx
mov byte [eax], 0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x488125
mov eax, dword [str._authSSP.dll]
mov dword [ecx], eax
mov eax, dword [0x549580]
mov dword [ecx + 4], eax
mov eax, dword [0x549584]
mov dword [ecx + 8], eax
mov al, byte [0x549588]
mov byte [ecx + 0xc], al
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x487de8
push str.vncEditSecurity
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x568a68]
push 0
call esi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425a60
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042c4d0
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042c570
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042c9b0
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0042ca70
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004259c0
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425920
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00425880
jmp 0x487de8
push 1
push 0
push 0
push str.http:__forum.uvnc.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x487de8
push 1
push 0
push 0
push str.http:__www.uvnc.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x487de8
push str.GlobalSessionEventUltra
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
mov dword [0x5a53b0], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x5a53b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [0x563180]
test eax, eax
cmovne edi, eax
test edi, edi
je 0x487de8
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x9c42
push 0x111
push edi
call esi
push 0
push 0
push 0x10
push edi
call esi
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004257e0
jmp 0x487de8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x7c]
push 0x104
push eax
call fcn.004d0170
add esp, 0xc
lea ecx, [esp + 0x78]
call fcn.004241f0
jmp 0x487de8