Function at 0x4046b0
Capabilities:
Hide graphical window
Initialize winsock library
Log keystrokes
Resolve dns

Disassembly:
sub esp, 0x2b0
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x2ac], eax
cmp byte [0x440c1e], 0
mov eax, dword [esp + 0x2b4]
push ebx
mov ebx, dword [esp + 0x2bc]
mov dword [esp + 4], eax
mov byte [esp + 0xb], 0
jne 0x404704
lea ecx, [esp + 0x20]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
cmp eax, 0xffffffff
je 0x404ef5
mov byte [0x440c1e], 1
mov edx, dword [0x44ba04]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push esi
push edi
push edx
call ebp
mov edi, eax
mov eax, dword [0x4534e8]
push 1
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, ebx
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404738
sub eax, edx
je 0x40476d
movsx ecx, byte [ebx + esi]
push ecx
call fcn.00413c4a
add esp, 4
test eax, eax
jne 0x40475a
cmp byte [ebx + esi], 0x2e
jne 0x40476d
mov eax, ebx
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404760
sub eax, edx
cmp esi, eax
jb 0x404743
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404772
sub eax, edx
push ebx
cmp esi, eax
jne 0x4047b4
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x404812
push 2
push 4
lea edx, [esp + 0x2c]
push edx
call sub.WS2_32.dll_gethostbyaddr
test eax, eax
je 0x404812
mov ecx, dword [eax]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4047a8
jmp 0x404812
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x404802
push eax
push eax
mov eax, dword [0x44f9e0]
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
call ebp
push ebx
push str.DebugView_could_not_resolve__s
push 0x4524c0
call fcn.004124f2
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x10
push 0x4346e4
push 0x4524c0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404ef2
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov byte [esp + 0x17], 1
mov dword [esp + 0x24], ecx
xor esi, esi
xor edi, edi
cmp dword [edi + 0x450024], 0
je 0x404848
lea edx, [edi + 0x450028]
push edx
push ebx
call fcn.00413a23
add esp, 8
test eax, eax
je 0x4048a1
mov eax, dword [edi + 0x45012c]
cmp eax, dword [esp + 0x24]
je 0x4048a1
cmp dword [edi + 0x450024], 0
jne 0x404851
cmp byte [edi + 0x450022], 0
je 0x404860
add edi, 0x160
inc esi
cmp edi, 0xdc0
jb 0x404816
cmp esi, 0xa
jne 0x404910
mov eax, dword [0x44f9e0]
push 0
push 0
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x1c]
push ecx
call ebp
mov edx, dword [esp + 0x10]
push 0x10
push 0x4346e4
push str.The_maximum_number_of_supported_clients_are_already_active.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404ef2
test esi, esi
jne 0x4048b9
push str.The_specified_computer_is_the_local_system
push 0x4524c0
call fcn.004124f2
add esp, 8
jmp 0x4048ef
mov ecx, esi
imul ecx, ecx, 0x160
cmp byte [ecx + 0x450022], 0
je 0x4048dc
mov edx, dword [esp + 0x10]
push 1
push esi
push edx
call fcn.00403c70
add esp, 0xc
jmp 0x404860
push ebx
push str.DebugView_is_already_connected_to__s
push 0x4524c0
call fcn.004124f2
add esp, 0xc
mov eax, dword [0x44f9e0]
push 0
push 0
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x1c]
push ecx
call ebp
jmp 0x404a14
push ebx
push str.Querying__s...
push 0x44a8c0
call fcn.004124f2
mov eax, dword [0x44f9e0]
add esp, 0xc
push 0x44a8c0
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, esi
imul edi, edi, 0x160
push 0x160
lea ebp, [edi + 0x450020]
push 0
push ebp
call fcn.00412880
add esp, 0xc
push 0
push 0
push 1
push 0
mov dword [0x43d36c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [edi + 0x450028]
mov dword [edi + 0x450174], eax
mov dword [edi + 0x450170], eax
mov eax, ebx
sub ecx, ebx
mov dl, byte [eax]
mov byte [eax + ecx], dl
inc eax
test dl, dl
jne 0x404983
mov ecx, dword [esp + 0x24]
mov dword [edi + 0x45012c], ecx
mov byte [edi + 0x45014c], 1
cmp byte [0x450df8], dl
je case.default.0x4049e5
cmp byte [esp + 0x17], dl
je case.default.0x4049e5
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1bc]
push edx
push ebx
push esi
push eax
mov byte [ebp], 1
call fcn.00404180
add esp, 0x10
test eax, eax
je case.default.0x4049e5
dec eax
mov byte [ebp], 0
cmp eax, 4
ja case.default.0x4049e5
jmp dword [eax*4 + 0x404f0c]
mov ecx, dword [0x44f9e0]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.The_DebugView_driver_currently_loaded_on_the_remote_system_is_of_an_incompatible_version._nPlease_reboot_the_target_machine_and_reconnect_to_synchronize_the_driver._n
push 0x4524c0
call fcn.004124f2
add esp, 8
mov edx, dword [esp + 0x10]
push 0x10
push 0x4346e4
push 0x4524c0
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404ef2
lea eax, [esp + 0x1bc]
push eax
push ebx
push str.DebugView_could_not_install_itself_on__s__s_n
jmp 0x404a6e
lea ecx, [esp + 0x1bc]
push ecx
push ebx
push str.DebugView_could_not_install_on__s__s_n
jmp 0x404a6e
lea edx, [esp + 0x1bc]
push edx
push ebx
push str.DebugView_could_not_start_on__s__s_n
jmp 0x404a6e
lea eax, [esp + 0x1bc]
push eax
push ebx
push str.DebugView_could_not_connect_with__s__s_n
push 0x4524c0
call fcn.004124f2
add esp, 0x10
cmp byte [ebp], 0
jne 0x404b92
push ebx
push str.Searching_for_DebugView_client_on__s...
push 0x44a8c0
mov byte [ebp], 0
call fcn.004124f2
mov ecx, dword [0x44f9e0]
add esp, 0xc
push 0x44a8c0
push 0
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x10]
push ebx
push esi
push edx
call fcn.00404580
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x404b92
mov eax, dword [0x44f9e0]
push 0
push 0
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
cmp ebp, 2
jne 0x404b13
push str.The_DebugView_driver_currently_loaded_on_the_remote_system_is_of_an_incompatible_version._nPlease_reboot_the_target_machine_and_reconnect_to_synchronize_the_driver._n
push 0x4524c0
call fcn.004124f2
add esp, 8
push 0x10
push 0x4346e4
push 0x4524c0
jmp 0x404b75
cmp ebp, 6
jne 0x404b3e
push ebx
push str.DebugView_could_not_resolve_the_IP_address_of__s.
push 0x4524c0
call fcn.004124f2
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0x10
push 0x4346e4
push 0x4524c0
push eax
jmp 0x404b7a
cmp ebp, 8
jne 0x404b69
push ebx
push str._s_did_not_respond_within_the_timeout_period.
push 0x4524c0
call fcn.004124f2
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x10
push 0x4346e4
push 0x4524c0
push ecx
jmp 0x404b7a
push 0x10
push 0x4346e4
push str.DebugView_did_not_locate_a_client_on_the_target_machine._n_nPlease_start_the_DebugView_client_on_the_target_machine_before_attempting_to_connect_to_it.
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [edi + 0x450174]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404ef2
movzx ecx, byte [0x43d365]
movzx edx, byte [0x43d376]
movzx eax, byte [0x43d374]
mov ebp, dword [esp + 0x10]
mov byte [edi + 0x450140], cl
movzx ecx, byte [0x43d367]
push 0
mov byte [edi + 0x450144], dl
movzx edx, byte [0x43d375]
push 1
mov byte [edi + 0x450141], cl
lea ecx, [esp + 0x28]
push ecx
mov byte [edi + 0x450145], dl
push 4
lea edx, [esp + 0x28]
push edx
mov byte [edi + 0x450142], al
movzx eax, byte [0x43d377]
push esi
push ebp
mov byte [edi + 0x450147], al
mov dword [esp + 0x34], 0x83050004
call fcn.004113c0
add esp, 0x1c
test eax, eax
je 0x404ce9
push 0
push 1
lea eax, [esp + 0x28]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
push ebp
mov dword [esp + 0x34], 0x83050008
call fcn.004113c0
add esp, 0x1c
test eax, eax
je 0x404ce9
push 0
push 1
lea edx, [esp + 0x28]
push edx
push 4
lea eax, [esp + 0x28]
push eax
push esi
push ebp
mov dword [esp + 0x34], 0x83050028
call fcn.004113c0
add esp, 0x1c
test eax, eax
je 0x404ce9
push 0
push 1
lea ecx, [esp + 0x28]
push ecx
push 8
lea edx, [edi + 0x450138]
push edx
push esi
push ebp
call fcn.00411570
add esp, 0x1c
cmp byte [0x43d365], 0
je 0x404d1b
cmp byte [0x43d376], 0
je 0x404cba
push 0
push 1
lea eax, [esp + 0x28]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
push ebp
mov dword [esp + 0x34], 0x83050000
call fcn.004113c0
add esp, 0x1c
test eax, eax
je 0x404ce9
cmp byte [0x43d374], 0
je 0x404d1b
push 0
push 1
lea edx, [esp + 0x28]
push edx
push 4
lea eax, [esp + 0x28]
push eax
push esi
push ebp
mov dword [esp + 0x34], 0x83050018
call fcn.004113c0
add esp, 0x1c
test eax, eax
jne 0x404d1b
mov ecx, dword [0x44f9e0]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
push 1
push esi
push ebp
call fcn.00403c70
add esp, 0xc
jmp 0x404ef2
mov eax, dword [0x440c28]
imul eax, eax, 0x160
mov ecx, dword [eax + 0x450024]
push 0
push ecx
call fcn.00402540
mov edx, dword [0x440c28]
imul edx, edx, 0x160
mov eax, dword [edx + 0x450024]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x44f9e0]
lea eax, [edi + 0x450024]
push eax
push 0
push 0x407
push ecx
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, ebp
push esi
push edx
call fcn.00401870
mov ebp, dword [sym.imp.USER32.dll_GetSubMenu]
add esp, 8
push ebx
lea eax, [esi + 0xc350]
push eax
mov eax, dword [0x449734]
push 0
push 4
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
cmp byte [0x43d365], 0
je 0x404db4
mov ecx, dword [0x44cf60]
mov eax, dword [0x44b8ec]
jmp 0x404dbf
mov ecx, dword [0x44985c]
mov eax, dword [0x452324]
push ecx
mov ecx, dword [0x449734]
push eax
push 0
lea eax, [esi + 0xc350]
push eax
push 4
push ecx
call ebp
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov edx, dword [0x440c28]
mov eax, dword [0x449734]
push 0
add edx, 0xc350
push edx
push 4
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [0x449734]
push 8
lea eax, [esi + 0xc350]
push eax
push 4
push ecx
call ebp
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ebp, dword [esp + 0x10]
push 0
push 0x9c63
push ebp
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x452380
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push 0x452380
mov byte [edi + 0x450022], 0
mov dword [0x449850], eax
mov dword [0x440c28], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push esi
push ebp
call fcn.00403550
mov ecx, dword [0x44f9e0]
add esp, 0xc
push ebx
push 0
push 0x404
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
xor ebp, ebp
mov edi, 0x449220
xor esi, esi
push ebx
push edi
call fcn.00413a23
add esp, 8
inc ebp
test eax, eax
je 0x404eaa
add esi, 0x101
add edi, 0x101
cmp esi, 0x505
jb 0x404e87
add ebp, 0xfffffffe
cmp ebp, 0xffffffff
je 0x404ee1
mov esi, ebp
imul esi, esi, 0x101
add esi, 0x449220
lea edi, [ebp + 1]
mov eax, esi
mov edx, 0x101
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x404ed0
sub esi, edx
sub edi, 1
jne 0x404ec3
mov ecx, 0x449220
sub ecx, ebx
mov al, byte [ebx]
mov byte [ebx + ecx], al
inc ebx
test al, al
jne 0x404ee8
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2b0]
pop ebx
xor ecx, esp
call fcn.004126a4
add esp, 0x2b0
ret