Function at 0x478d00
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
push 0xa
mov eax, dword [ebx]
mov dword [ebp - 0xc34], ecx
push ecx
mov ecx, ebx
call dword [eax + 0x14]
mov esi, eax
test esi, esi
je 0x479215
push 0x400
lea eax, [ebp - 0x41c]
push eax
push str.GET__s
push esi
call fcn.0043f050
push esi
mov edi, eax
call fcn.00524771
add esp, 0x14
test edi, edi
je 0x479215
cmp edi, 0xffffffff
je 0x479215
lea eax, [ebp - 0x41c]
push eax
push str.vncHTTPConnectThread::DoHTTP_:_file__s_requested_n
push 1
push 0x5c3db0
call fcn.0041dde0
mov edi, dword [ebp - 0xc34]
lea eax, [ebp - 0xc2d]
add esp, 0xc
mov ecx, edi
mov esi, 1
push eax
call fcn.0048f260
test eax, eax
je 0x479215
mov al, byte [ebp - 0xc2d]
cmp al, 0xa
jne 0x478db9
test esi, esi
jne 0x478de6
mov esi, 1
jmp 0x478dc0
xor ecx, ecx
cmp al, 0x20
cmovge esi, ecx
push ecx
lea eax, [ebp - 0xc2d]
mov ecx, edi
push eax
call fcn.0048f260
test eax, eax
jne 0x478da4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 4
push str.vncHTTPConnectThread::DoHTTP_:_parameters_read_n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
cmp byte [ebp - 0x41c], 0x2f
je 0x478e3b
push str.vncHTTPConnectThread::DoHTTP_:_filename_didnt_begin_with___n
push 0
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
mov ecx, edi
push 0xa8
push str.HTTP_1.0_404_Not_Found_n_n_HTML__n___HEAD__TITLE_404_Not_Found__TITLE___HEAD__n___BODY__n_____H1_Not_Found__H1__n____The_requested_file_could_not_be_found._n____BODY__n__HTML__n
call fcn.0048eb60
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x5b2798
lea eax, [ebp - 0x41c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x478e66
test dl, dl
je 0x478e62
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x478e66
add eax, 2
add ecx, 2
test dl, dl
jne 0x478e46
xor eax, eax
jmp 0x478e6b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x478fca
push str.vncHTTPConnectThread::DoHTTP_:_sending_main_page_n
push 1
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
mov ecx, edi
push 0x11
push str.HTTP_1.0_200_OK_n_n
call fcn.0048eb60
cmp eax, 0x11
jne 0x479215
mov ecx, dword [ebx + 0x58]
mov eax, dword [ecx]
call dword [eax + 0xd0]
test eax, eax
je 0x478f7c
mov ecx, dword [ebx + 0x58]
lea edx, [ebp - 0xc40]
push edx
lea edx, [ebp - 0xc38]
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0xc3c]
push edx
call dword [eax + 0xe0]
lea eax, [ebp - 0xc34]
mov dword [ebp - 0xc34], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x478f2f
lea ecx, [ebp - 0x18]
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x478ef8
sub ecx, edx
je 0x478f42
movsx eax, byte [ebp + esi - 0x18]
push eax
call fcn.00534aa9
lea ecx, [ebp - 0x18]
mov byte [ebp + esi - 0x18], al
add esp, 4
lea edx, [ecx + 1]
inc esi
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x478f20
sub ecx, edx
cmp esi, ecx
jb 0x478f03
jmp 0x478f42
push 0x5adfa8
lea eax, [ebp - 0x18]
push 0x10
push eax
call fcn.0052c1a3
add esp, 0xc
mov eax, dword [0x5d1914]
mov ecx, dword [ebp - 0xc38]
add ecx, 0x20
mov edx, dword [eax + 0x72c]
mov eax, dword [ebp - 0xc3c]
push edx
push ecx
push eax
push edx
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc2c]
push str._HTML__n___HEAD__TITLE____.256s____TITLE___HEAD__n___BODY__n___SPAN_styleposition:_absolute__top:0px_left:0px__n_OBJECT__n____IDVncViewer_n____classid__clsid:8AD9C840_044E_11D1_B3E9_00805F499D93_n____codebase__http:__java.sun.com_update_1.4.2_jinstall_1_4_windows_i586.cabVersion1_4_0_0_n____WIDTH___d_HEIGHT___d___n_____PARAM_NAME__CODE_VALUE__VncViewer.class___n_____PARAM_NAME__ARCHIVE_VALUE__VncViewer.jar___n_____PARAM_NAME__type_VALUE__application_x_java_applet_version1.4__n_____PARAM_NAME__scriptable_VALUE__false__n_____PARAM_NAME__PORT_VALUE_d__n_____PARAM_NAME__ENCODING_VALUETight__n_____PARAM_NAME__Open_New_Window_VALUEYes__n_____COMMENT__n_t_EMBED__n____________type__application_x_java_applet_version1.4__n____________CODE__VncViewer.class__n____________ARCHIVE__VncViewer.jar__n____________WIDTH___d__n____________HEIGHT___d__n____________PORT__d__n____________ENCODING_Tight__n_t____scriptable__false__n_t____pluginspage_http:__java.sun.com_products_plugin_index.htmldownload__n_t_____NOEMBED__n______________NOEMBED__n_t__EMBED__n______COMMENT__n__OBJECT__n____SPAN__n____BODY__n__HTML__n
push eax
call fcn.004795e0
add esp, 0x24
jmp 0x478f90
lea eax, [ebp - 0xc2c]
push str._HTML__n___HEAD__TITLE_UltraVNC_desktop__TITLE___HEAD__n___BODY__n_____H1_Connections_Disabled__H1__n____The_requested_desktop_is_not_configured_to_accept_incoming_connections._n____BODY__n__HTML__n
push eax
call fcn.004795e0
add esp, 8
lea esi, [ebp - 0xc2c]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x478fa0
sub esi, ecx
lea eax, [ebp - 0xc2c]
push esi
push eax
mov ecx, edi
call fcn.0048eb60
cmp eax, esi
jne 0x479215
push str.vncHTTPConnectThread::DoHTTP_:_sent_page_n
jmp 0x479206
mov eax, dword [0x5d1914]
xor edi, edi
cmp dword [eax + 0x7a4], edi
je 0x4790f1
mov esi, 0x57b5ac
mov ecx, dword [esi]
lea eax, [ebp - 0x41c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x479010
test dl, dl
je 0x47900c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x479010
add eax, 2
add ecx, 2
test dl, dl
jne 0x478ff0
xor eax, eax
jmp 0x479015
sbb eax, eax
or eax, 1
test eax, eax
je 0x47902a
add esi, 0xc
inc edi
cmp esi, str._HTML__n___HEAD__TITLE_UltraVNC_desktop__TITLE___HEAD__n___BODY__n_____H1_Connections_Disabled__H1__n____The_requested_desktop_is_not_configured_to_accept_incoming_connections._n____BODY__n__HTML__n
jl 0x478fe2
jmp 0x479135
push str.vncHTTPConnectThread::DoHTTP_:_requested_file_recognised_n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea eax, [edi + edi*2]
push dword [eax*4 + 0x57b5b0]
movzx eax, word [eax*4 + 0x57b5b4]
push eax
push dword [0x5d0700]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x479215
push esi
push dword [0x5d0700]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x5d0700]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x479215
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x479215
push str.vncHTTPConnectThread::DoHTTP_:_sending_file..._n
push 9
push 0x5c3db0
call fcn.0041dde0
mov ebx, dword [ebp - 0xc34]
add esp, 0xc
mov ecx, ebx
push 0x11
push str.HTTP_1.0_200_OK_n_n
call fcn.0048eb60
cmp eax, 0x11
jne 0x479215
push edi
push esi
mov ecx, ebx
call fcn.0048f240
test eax, eax
jne 0x479201
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 4
mov esi, 0x57b4f0
mov ecx, dword [esi]
lea eax, [ebp - 0x41c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x479120
test dl, dl
je 0x47911c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x479120
add eax, 2
add ecx, 2
test dl, dl
jne 0x479100
xor eax, eax
jmp 0x479125
sbb eax, eax
or eax, 1
test eax, eax
je 0x47915d
add esi, 0xc
inc edi
cmp esi, 0x57b4fc
jl 0x4790f6
mov ecx, dword [ebp - 0xc34]
push 0xa8
push str.HTTP_1.0_404_Not_Found_n_n_HTML__n___HEAD__TITLE_404_Not_Found__TITLE___HEAD__n___BODY__n_____H1_Not_Found__H1__n____The_requested_file_could_not_be_found._n____BODY__n__HTML__n
call fcn.0048eb60
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret 4
push str.vncHTTPConnectThread::DoHTTP_:_requested_file_recognised_n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
lea eax, [edi + edi*2]
push dword [eax*4 + 0x57b4f4]
movzx eax, word [eax*4 + 0x57b4f8]
push eax
push dword [0x5d0700]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x479215
push esi
push dword [0x5d0700]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x5d0700]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x479215
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x479215
push str.vncHTTPConnectThread::DoHTTP_:_sending_file..._n
push 9
push 0x5c3db0
call fcn.0041dde0
mov ebx, dword [ebp - 0xc34]
add esp, 0xc
mov ecx, ebx
push 0x11
push str.HTTP_1.0_200_OK_n_n
call fcn.0048eb60
cmp eax, 0x11
jne 0x479215
push edi
push esi
mov ecx, ebx
call fcn.0048f240
test eax, eax
je 0x479215
push str.vncHTTPConnectThread::DoHTTP_:_file_successfully_sent_n
push 9
push 0x5c3db0
call fcn.0041dde0
add esp, 0xc
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00524763
mov esp, ebp
pop ebp
ret 4