Function at 0x404270
Capabilities:
Hide graphical window
Initialize winsock library
Log keystrokes
Resolve dns

Disassembly:
sub esp, 0x2a8
mov al, byte [0x425848]
push ebx
push ebp
push esi
test al, al
push edi
mov byte [esp + 0x13], 0
jne 0x4042aa
lea eax, [esp + 0x128]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
cmp eax, 0xffffffff
je 0x404ba5
mov byte [0x425848], 1
mov ecx, dword [0x42e900]
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push ecx
call ebp
mov edx, dword [0x4323e4]
push 1
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, dword [esp + 0x2c0]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40432f
cmp dword [0x41f7fc], 1
jle 0x404304
movsx eax, byte [esi + ebx]
push 4
push eax
call fcn.004110a1
add esp, 8
jmp 0x404314
movsx ecx, byte [esi + ebx]
mov edx, dword [0x41f5f0]
mov al, byte [edx + ecx*2]
and eax, 4
test eax, eax
jne 0x40431e
cmp byte [esi + ebx], 0x2e
jne 0x40432f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jb 0x4042ea
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jne 0x404389
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x4043f4
push 2
lea eax, [esp + 0x24]
push 4
push eax
call sub.WS2_32.dll_gethostbyaddr
test eax, eax
je 0x4043f4
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4043f4
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x4043e4
push eax
push eax
mov eax, dword [0x42fd24]
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x18]
push ecx
call ebp
push ebx
push str.DebugView_could_not_resolve__s
push 0x435820
call fcn.00410876
mov edx, dword [esp + 0x2c8]
add esp, 0xc
push 0x10
push 0x41d1a4
push 0x435820
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
mov eax, dword [eax + 0xc]
mov byte [esp + 0x13], 1
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
xor ebp, ebp
mov esi, 0x431624
cmp dword [esi], 0
je 0x404424
lea eax, [esi + 4]
push eax
push ebx
call fcn.00419410
add esp, 8
test eax, eax
je 0x404489
mov ecx, dword [esi + 0x108]
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x404489
cmp dword [esi], 0
jne 0x40442b
mov al, byte [esi - 2]
test al, al
je 0x40443a
add esi, 0x160
inc ebp
cmp esi, 0x4323e4
jb 0x4043fb
cmp ebp, 0xa
jne 0x404527
mov edx, dword [0x42fd24]
push 0
push 0
push 0x403
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x2bc]
push 0x10
push 0x41d1a4
push str.The_maximum_number_of_supported_clients_are_already_active.
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
test ebp, ebp
jne 0x4044a1
push str.The_specified_computer_is_the_local_system
push 0x435820
call fcn.00410876
add esp, 8
jmp 0x4044e1
lea edx, [ebp + ebp*4]
lea eax, [ebp + edx*2]
shl eax, 5
mov cl, byte [eax + 0x431622]
test cl, cl
je 0x4044ce
mov ecx, dword [esp + 0x2bc]
push 1
push ebp
push ecx
call fcn.004038b0
add esp, 0xc
jmp 0x40443a
push ebx
push str.DebugView_is_already_connected_to__s
push 0x435820
call fcn.00410876
add esp, 0xc
mov edx, dword [0x42fd24]
push 0
push 0
push 0x403
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x2bc]
push 0x10
push 0x41d1a4
push 0x435820
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
push ebx
push str.Querying__s...
push 0x42d900
call fcn.00410876
mov edx, dword [0x42fd24]
add esp, 0xc
push 0x42d900
push 0
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp + ebp*4]
mov ecx, 0x58
mov dword [0x41d554], ebp
lea ebx, [ebp + eax*2]
xor eax, eax
shl ebx, 5
push eax
push eax
lea edi, [ebx + 0x431620]
push 1
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [esp + 0x2c0]
mov dword [ebx + 0x431774], eax
mov dword [ebx + 0x431770], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebx + 0x431628]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x24], esi
mov esi, edi
mov edi, dword [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [0x42d8e4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x43172c], ecx
mov byte [ebx + 0x43174c], 1
test al, al
je 0x4046ee
mov al, byte [esp + 0x13]
test al, al
je 0x4046ee
mov esi, dword [esp + 0x2bc]
lea eax, [esp + 0x28]
push eax
push edx
push ebp
push esi
mov byte [ebx + 0x431620], 1
call fcn.00403da0
add esp, 0x10
test eax, eax
je case.default.0x40461d
dec eax
mov byte [ebx + 0x431620], 0
cmp eax, 4
ja case.default.0x40461d
jmp dword [eax*4 + 0x404bb0]
mov ecx, dword [0x42fd24]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.The_DebugView_driver_currently_loaded_on_the_remote_system_is_of_an_incompatible_version._nPlease_reboot_the_target_machine_and_reconnect_to_synchronize_the_driver._n
push 0x435820
call fcn.00410876
add esp, 8
push 0x10
push 0x41d1a4
push 0x435820
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
mov eax, dword [esp + 0x2c0]
lea edx, [esp + 0x28]
push edx
push eax
push str.DebugView_could_not_install_itself_on__s__s_n
push 0x435820
call fcn.00410876
add esp, 0x10
jmp case.default.0x40461d
mov edx, dword [esp + 0x2c0]
lea ecx, [esp + 0x28]
push ecx
push edx
push str.DebugView_could_not_install_on__s__s_n
push 0x435820
call fcn.00410876
add esp, 0x10
jmp case.default.0x40461d
mov ecx, dword [esp + 0x2c0]
lea eax, [esp + 0x28]
push eax
push ecx
push str.DebugView_could_not_start_on__s__s_n
push 0x435820
call fcn.00410876
add esp, 0x10
jmp case.default.0x40461d
mov eax, dword [esp + 0x2c0]
lea edx, [esp + 0x28]
push edx
push eax
push str.DebugView_could_not_connect_with__s__s_n
push 0x435820
call fcn.00410876
add esp, 0x10
jmp case.default.0x40461d
mov esi, dword [esp + 0x2bc]
mov al, byte [ebx + 0x431620]
test al, al
jne 0x404824
mov ecx, dword [esp + 0x2c0]
mov byte [ebx + 0x431620], 0
push ecx
push str.Searching_for_DebugView_client_on__s...
push 0x42d900
call fcn.00410876
mov edx, dword [0x42fd24]
add esp, 0xc
push 0x42d900
push 0
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x2c0]
push eax
push ebp
push esi
call fcn.00404180
mov edi, eax
add esp, 0xc
test edi, edi
je 0x404824
mov ecx, dword [0x42fd24]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
cmp edi, 2
jne 0x40479f
push str.The_DebugView_driver_currently_loaded_on_the_remote_system_is_of_an_incompatible_version._nPlease_reboot_the_target_machine_and_reconnect_to_synchronize_the_driver._n
push 0x435820
call fcn.00410876
add esp, 8
push 0x10
push 0x41d1a4
push 0x435820
jmp 0x404805
cmp edi, 6
jne 0x4047cc
mov eax, dword [esp + 0x2c0]
push eax
push str.DebugView_could_not_resolve_the_IP_address_of__s.
push 0x435820
call fcn.00410876
add esp, 0xc
push 0x10
push 0x41d1a4
push 0x435820
jmp 0x404805
cmp edi, 8
jne 0x4047f9
mov ecx, dword [esp + 0x2c0]
push ecx
push str._s_did_not_respond_within_the_timeout_period.
push 0x435820
call fcn.00410876
add esp, 0xc
push 0x10
push 0x41d1a4
push 0x435820
jmp 0x404805
push 0x10
push 0x41d1a4
push str.DebugView_did_not_locate_a_client_on_the_target_machine._n_nPlease_start_the_DebugView_client_on_the_target_machine_before_attempting_to_connect_to_it.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebx + 0x431774]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
mov al, byte [0x41d55c]
mov cl, byte [0x41d561]
mov dl, byte [0x41d55f]
mov byte [ebx + 0x431740], al
mov al, byte [0x41d55e]
mov byte [ebx + 0x431744], cl
mov cl, byte [0x41d560]
mov byte [ebx + 0x431742], dl
mov dl, byte [0x41d562]
mov byte [ebx + 0x431741], al
push 0
lea eax, [esp + 0x20]
mov byte [ebx + 0x431745], cl
push 1
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push ebp
push esi
mov byte [ebx + 0x431746], dl
mov dword [esp + 0x30], 0x83050004
call fcn.0040fe50
add esp, 0x1c
test al, al
je 0x40496f
push 0
lea edx, [esp + 0x20]
push 1
push edx
lea eax, [esp + 0x20]
push 4
push eax
push ebp
push esi
mov dword [esp + 0x30], 0x83050008
call fcn.0040fe50
add esp, 0x1c
test al, al
je 0x40496f
push 0
lea ecx, [esp + 0x20]
push 1
push ecx
lea edx, [esp + 0x20]
push 4
push edx
push ebp
push esi
mov dword [esp + 0x30], 0x83050028
call fcn.0040fe50
add esp, 0x1c
test al, al
je 0x40496f
push 0
lea eax, [esp + 0x20]
push 1
push eax
lea ecx, [ebx + 0x431738]
push 8
push ecx
push ebp
push esi
call fcn.00410010
mov al, byte [0x41d55c]
add esp, 0x1c
test al, al
je 0x4049a6
mov al, byte [0x41d561]
test al, al
je 0x404940
push 0
lea edx, [esp + 0x20]
push 1
push edx
lea eax, [esp + 0x20]
push 4
push eax
push ebp
push esi
mov dword [esp + 0x30], 0x83050000
call fcn.0040fe50
add esp, 0x1c
test al, al
je 0x40496f
mov al, byte [0x41d55f]
test al, al
je 0x4049a6
push 0
lea ecx, [esp + 0x20]
push 1
push ecx
lea edx, [esp + 0x20]
push 4
push edx
push ebp
push esi
mov dword [esp + 0x30], 0x83050018
call fcn.0040fe50
add esp, 0x1c
test al, al
jne 0x4049a6
mov eax, dword [0x42fd24]
push 0
push 0
push 0x403
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
push 1
push ebp
push esi
call fcn.004038b0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret
mov eax, dword [0x4247f4]
push 0
lea edx, [eax + eax*4]
lea eax, [eax + edx*2]
shl eax, 5
mov ecx, dword [eax + 0x431624]
push ecx
call fcn.00402380
mov eax, dword [0x4247f4]
add esp, 8
lea edx, [eax + eax*4]
push 0
lea eax, [eax + edx*2]
shl eax, 5
mov ecx, dword [eax + 0x431624]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x42fd24]
lea eax, [ebx + 0x431624]
push eax
push 0
push 0x407
push edx
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push esi
call fcn.00401830
mov ecx, dword [esp + 0x2c8]
mov edx, dword [0x4357f0]
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
add esp, 8
lea eax, [ebp + 0xc350]
push ecx
push eax
push 0
push 4
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
mov al, byte [0x41d55c]
test al, al
je 0x404a4a
mov ecx, dword [0x4313a8]
mov eax, dword [0x435804]
jmp 0x404a55
mov ecx, dword [0x42fd20]
mov eax, dword [0x430d88]
push ecx
push eax
lea eax, [ebp + 0xc350]
push 0
push eax
mov eax, dword [0x4357f0]
push 4
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov ecx, dword [0x4247f4]
mov edx, dword [0x4357f0]
add ecx, 0xc350
push 0
push ecx
push 4
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea eax, [ebp + 0xc350]
push 8
push eax
mov eax, dword [0x4357f0]
push 4
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x9c63
push esi
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x432640
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x24]
mov byte [ebx + 0x431622], 0
push 0x432640
mov dword [0x4247f4], ebp
mov edx, dword [ecx]
mov dword [0x4313b0], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
push ebp
push esi
call fcn.004031d0
mov edi, dword [esp + 0x2cc]
mov eax, dword [0x42fd24]
add esp, 0xc
push edi
push 0
push 0x404
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
mov esi, 0x433280
push edi
push esi
call fcn.00419410
add esp, 8
test eax, eax
je 0x404b3c
add esi, 0x101
inc ebx
cmp esi, 0x433785
jb 0x404b1d
jmp 0x404b3d
inc ebx
lea eax, [ebx - 2]
cmp eax, 0xffffffff
je 0x404b85
mov ecx, eax
lea ebp, [eax + 1]
shl ecx, 8
lea edx, [ecx + eax + 0x433381]
lea ebx, [edx - 0x101]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x404b54
mov edi, dword [esp + 0x2c0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x433280
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a8
ret