Function at 0x401ee0
Capabilities:
Get file size
Get hostname
Resolve dns

Disassembly:
sub esp, 0x108
lea eax, [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
push 0x100
push eax
lea ebp, [esi + 0xf0]
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x401f5b
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x401f5f
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x401f5f
mov ecx, dword [eax]
xor edi, edi
test ecx, ecx
je 0x401f4e
mov esi, dword [esi + 0x10]
mov edx, dword [0x415028]
and esi, edx
mov edx, eax
mov ecx, dword [ecx]
and ecx, dword [0x415028]
cmp ecx, esi
je 0x401f4e
mov ecx, dword [edx + 4]
add edx, 4
inc edi
test ecx, ecx
jne 0x401f37
mov eax, dword [eax + edi*4]
test eax, eax
je 0x401f63
mov dword [esp + 0x14], eax
jmp 0x401f7a
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x401f72
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
jmp 0x401f7a
mov dword [esp + 0x14], 0x412080
test byte [0x413850], 1
je 0x401f93
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov edx, dword [ecx]
mov dword [eax + 0x14], edx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x41208c
mov dword [esp + 0x10], edi
cmp byte [edi], 0
je 0x401fb4
mov cl, byte [edi - 4]
mov byte [ebp], cl
mov dl, byte [edi]
inc ebp
mov byte [ebp], dl
inc ebp
mov eax, dword [edi - 4]
dec eax
cmp eax, 0xfe
ja case.0x401fcb.14
xor ecx, ecx
mov cl, byte [eax + 0x4021ac]
jmp dword [ecx*4 + 0x402174]
mov dl, byte [esp + 0x120]
mov byte [ebp], dl
jmp case.0x401fcb.14
test byte [0x413850], 8
je case.0x401fcb.14
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [ebp], ecx
jmp case.0x401fcb.14
mov edx, dword [0x415028]
mov dword [ebp], edx
jmp case.0x401fcb.14
mov eax, dword [0x415030]
mov dword [ebp], eax
jmp case.0x401fcb.14
mov ecx, dword [0x41502c]
mov dword [ebp], ecx
jmp case.0x401fcb.14
push 0x2a300
call sub.WSOCK32.dll_htonl
mov dword [ebp], eax
jmp case.0x401fcb.14
push 0x15180
call sub.WSOCK32.dll_htonl
mov dword [ebp], eax
jmp case.0x401fcb.14
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push 0x415034
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x401fcb.14
mov byte [ebp], 0xd
inc ebp
push 0
push esi
mov byte [ebp], 2
inc ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
shr eax, 9
inc eax
push eax
call sub.WSOCK32.dll_htons
mov word [ebp], ax
push esi
add ebp, 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401fcb.14
mov al, byte [0x415134]
test al, al
je case.0x401fcb.14
mov byte [ebp], 0xf
push 0x415134
inc ebp
call ebx
mov ecx, eax
mov byte [ebp], al
and ecx, 0xff
mov esi, 0x415134
jmp 0x402116
mov eax, dword [0x415174]
test eax, eax
je case.0x401fcb.14
mov byte [ebp], al
push 0x415178
inc ebp
call ebx
mov ecx, eax
mov byte [ebp], al
and ecx, 0xff
mov esi, 0x415178
jmp 0x402116
mov eax, dword [0x4151b8]
test eax, eax
je case.0x401fcb.14
mov byte [ebp], al
push 0x4151bc
inc ebp
call ebx
mov ecx, eax
mov byte [ebp], al
and ecx, 0xff
mov esi, 0x4151bc
mov edx, ecx
lea edi, [ebp + 1]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebp]
mov edi, dword [esp + 0x10]
lea ebp, [eax + ebp + 1]
jmp case.0x401fcb.14
mov byte [ebp], 0xff
inc ebp
mov byte [ebp], 0
inc ebp
mov byte [ebp], 0
inc ebp
movsx ecx, byte [edi]
add edi, 5
add ebp, ecx
cmp edi, 0x4120d7
mov dword [esp + 0x10], edi
jl 0x401fa2
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, ebp
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x108
ret