Function at 0x446980
Capabilities:
Extract resource via kernel32 functions
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov edx, dword [ebx]
push 0xa
mov dword [ebp - 0xc34], eax
push eax
mov eax, dword [edx + 0x14]
call eax
mov edi, eax
test edi, edi
je 0x446cf2
lea ecx, [ebp - 0x41c]
push ecx
push str.GET__s
push edi
call fcn.004aa12c
add esp, 0xc
push edi
mov esi, eax
call fcn.004a9011
add esp, 4
test esi, esi
je 0x446cf2
cmp esi, 0xffffffff
je 0x446cf2
lea edx, [ebp - 0x41c]
push edx
push str.vnchttpconnect.cpp_:_file__s_requested_n
mov eax, 1
mov ecx, 0x4ecb00
call fcn.00403230
mov esi, dword [ebp - 0xc34]
add esp, 8
lea eax, [ebp - 0xc2d]
push eax
push esi
mov edi, 1
call fcn.00460fd0
test eax, eax
je 0x446cf2
mov al, byte [ebp - 0xc2d]
cmp al, 0xa
jne 0x446a39
test edi, edi
jne 0x446a63
mov edi, 1
jmp 0x446a3f
cmp al, 0x20
jl 0x446a3f
xor edi, edi
lea ecx, [ebp - 0xc2d]
push ecx
push esi
call fcn.00460fd0
test eax, eax
jne 0x446a24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 4
push str.vnchttpconnect.cpp_:_parameters_read_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
cmp byte [ebp - 0x41c], 0x2f
je 0x446a9c
push str.vnchttpconnect.cpp_:_filename_didnt_begin_with___n
xor eax, eax
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
jmp 0x446ce3
mov edx, 0x4d647c
lea ecx, [ebp - 0x41c]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x446ac7
test al, al
je 0x446ac3
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x446ac7
add ecx, 2
add edx, 2
test al, al
jne 0x446aa7
xor eax, eax
jmp 0x446acc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x446c7b
push str.vnchttpconnect.cpp_:_sending_main_page_n
mov eax, 1
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push 0x11
push str.HTTP_1.0_200_OK_n_n
call fcn.00460700
cmp eax, 0x11
jne 0x446cf2
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x160]
call eax
test eax, eax
je 0x446c14
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov edx, dword [edx + 0x184]
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0xc38]
push eax
call edx
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0xc40], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x446b9f
lea eax, [ebp - 0x18]
xor edi, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446b60
sub eax, edx
je 0x446bbb
jmp 0x446b70
movsx edx, byte [ebp + edi - 0x18]
push edx
call fcn.004ab46d
mov byte [ebp + edi - 0x18], al
lea eax, [ebp - 0x18]
add esp, 4
inc edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446b90
sub eax, edx
cmp edi, eax
jb 0x446b70
jmp 0x446bbb
mov eax, dword [0x4d8a6c]
mov cx, word [0x4d8a70]
mov dl, byte [0x4d8a72]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], dl
mov ecx, dword [ebx + 0x64]
mov eax, dword [ecx]
mov edx, dword [eax + 0x114]
mov edi, ecx
call edx
mov ecx, dword [ebp - 0xc38]
mov edx, dword [edi]
push eax
mov eax, dword [ebp - 0xc3c]
add eax, 0x20
push eax
mov eax, dword [edx + 0x114]
push ecx
mov ecx, edi
call eax
mov ecx, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xc38]
push eax
add ecx, 0x20
push ecx
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc2c]
push str._HTML__n___HEAD__TITLE____.256s____TITLE___HEAD__n___BODY__n___SPAN_styleposition:_absolute__top:0px_left:0px__n_OBJECT__n____IDVncViewer_n____classid__clsid:8AD9C840_044E_11D1_B3E9_00805F499D93_n____codebase__http:__java.sun.com_update_1.4.2_jinstall_1_4_windows_i586.cabVersion1_4_0_0_n____WIDTH___d_HEIGHT___d___n_____PARAM_NAME__CODE_VALUE__VncViewer.class___n_____PARAM_NAME__ARCHIVE_VALUE__VncViewer.jar___n_____PARAM_NAME__type_VALUE__application_x_java_applet_version1.4__n_____PARAM_NAME__scriptable_VALUE__false__n_____PARAM_NAME__PORT_VALUE_d__n_____PARAM_NAME__ENCODING_VALUETight__n_____PARAM_NAME__Open_New_Window_VALUEYes__n_____COMMENT__n_t_EMBED__n____________type__application_x_java_applet_version1.4__n____________CODE__VncViewer.class__n____________ARCHIVE__VncViewer.jar__n____________WIDTH___d__n____________HEIGHT___d__n____________PORT__d__n____________ENCODING_Tight__n_t____scriptable__false__n_t____pluginspage_http:__java.sun.com_products_plugin_index.htmldownload__n_t_____NOEMBED__n______________NOEMBED__n_t__EMBED__n______COMMENT__n__OBJECT__n____SPAN__n____BODY__n__HTML__n
push ecx
call fcn.004a931b
add esp, 0x24
jmp 0x446c28
lea edx, [ebp - 0xc2c]
push str._HTML__n___HEAD__TITLE_UltraVNC_desktop__TITLE___HEAD__n___BODY__n_____H1_Connections_Disabled__H1__n____The_requested_desktop_is_not_configured_to_accept_incoming_connections._n____BODY__n__HTML__n
push edx
call fcn.004a931b
add esp, 8
lea eax, [ebp - 0xc2c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446c31
sub eax, edx
mov edi, eax
push edi
lea eax, [ebp - 0xc2c]
push eax
call fcn.00460700
cmp eax, edi
jne 0x446cf2
push str.vnchttpconnect.cpp_:_sent_page_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x220]
call eax
xor edi, edi
test eax, eax
je 0x446dc4
mov esi, 0x4d45c8
jmp 0x446ca0
mov ecx, dword [esi]
lea eax, [ebp - 0x41c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x446cc8
test dl, dl
je 0x446cc4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x446cc8
add eax, 2
add ecx, 2
test dl, dl
jne 0x446ca8
xor eax, eax
jmp 0x446ccd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x446d05
add esi, 0xc
inc edi
cmp esi, str.WinVNC_desktop_sink
jl 0x446ca0
mov esi, dword [ebp - 0xc34]
push 0xa8
push str.HTTP_1.0_404_Not_Found_n_n_HTML__n___HEAD__TITLE_404_Not_Found__TITLE___HEAD__n___BODY__n_____H1_Not_Found__H1__n____The_requested_file_could_not_be_found._n____BODY__n__HTML__n
call fcn.00460700
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 4
push str.vnchttpconnect.cpp_:_requested_file_recognised_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
lea eax, [edi + edi*2]
add eax, eax
mov ecx, dword [eax + eax + 0x4d45cc]
movzx edx, word [eax + eax + 0x4d45d0]
add esp, 4
add eax, eax
mov eax, dword [0x513794]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x446cf2
mov ecx, dword [0x513794]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x513794]
push edi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x446cf2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x446cf2
push str.vnchttpconnect.cpp_:_sending_file..._n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
mov esi, dword [ebp - 0xc34]
add esp, 4
push 0x11
push str.HTTP_1.0_200_OK_n_n
call fcn.00460700
cmp eax, 0x11
jne 0x446cf2
push ebx
push edi
call fcn.00460700
cmp eax, ebx
jne 0x446cf2
push str.vnchttpconnect.cpp_:_file_successfully_sent_n
jmp 0x446c56
mov esi, 0x4d45bc
lea esp, [esp]
mov ecx, dword [esi]
lea eax, [ebp - 0x41c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x446df8
test dl, dl
je 0x446df4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x446df8
add eax, 2
add ecx, 2
test dl, dl
jne 0x446dd8
xor eax, eax
jmp 0x446dfd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x446e12
add esi, 0xc
inc edi
cmp esi, 0x4d45c8
jl 0x446dd0
jmp 0x446cdd
push str.vnchttpconnect.cpp_:_requested_file_recognised_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
lea eax, [edi + edi*2]
add eax, eax
mov ecx, dword [eax + eax + 0x4d45c0]
movzx edx, word [eax + eax + 0x4d45c4]
add esp, 4
add eax, eax
jmp 0x446d32