Function at 0x4989e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4e618f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
mov al, byte [esp + 3]
push ebx
push ebp
push esi
push edi
push 0
lea ecx, [esp + 0xb0]
mov byte [esp + 0xb0], al
call fcn.00407180
mov edi, 0x5188e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x5188e8
lea ecx, [esp + 0xb4]
call fcn.00406da0
mov cl, byte [esp + 0x13]
push 0
mov byte [esp + 0x80], cl
lea ecx, [esp + 0x80]
mov dword [esp + 0xcc], 0
call fcn.00407180
mov edi, 0x5188e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x5188e8
lea ecx, [esp + 0x84]
call fcn.00406da0
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
mov byte [esp + 0x54], dl
call fcn.00407180
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
mov byte [esp + 0x34], al
call fcn.00407180
mov cl, byte [esp + 0x13]
push 0
mov byte [esp + 0x70], cl
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00407180
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
mov byte [esp + 0x90], dl
call fcn.00407180
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
mov byte [esp + 0x44], al
call fcn.00407180
mov ebp, dword [esp + 0xd0]
mov byte [esp + 0xc8], 6
mov cx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov bx, ax
mov al, byte [ebp + 0xe]
and ebx, 0xffff
test al, al
je 0x498ba6
xor edx, edx
mov byte [esp + 0x13], 0
mov dl, byte [ebx + ebp + 0x1a]
mov al, byte [esp + 0x13]
mov esi, edx
push 0
shr esi, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
shl esi, 2
call fcn.00407180
mov edi, 0x5188e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x5188e8
lea ecx, [esp + 0x24]
call fcn.00406da0
sub ebx, esi
mov byte [esp + 0xc8], 7
test ebx, ebx
lea ebp, [esi + ebp + 0xe]
mov dword [esp + 0x2c], ebx
jg 0x498c3e
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0xcc], 6
call fcn.00407180
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
call fcn.00407180
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
call fcn.00407180
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00407180
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
call fcn.00407180
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
call fcn.00407180
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 0
call fcn.00407180
push 1
lea ecx, [esp + 0xb0]
mov dword [esp + 0xcc], 0xffffffff
call fcn.00407180
xor al, al
jmp 0x4994ee
cmp ebx, 0xbb8
jle 0x498c4e
mov dword [esp + 0x2c], 0xbb8
mov edi, 0x5188e8
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x5188e8
lea ecx, [esp + 0x38]
call fcn.00406da0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x60], ebx
cmp eax, ebx
jle 0x4991c1
mov edi, 3
mov esi, ebp
sub edi, ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0xa8], edi
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x498cf2
lea ecx, [edi + esi]
cmp ecx, eax
jge 0x4991ab
mov edi, str.GET
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.GET
push esi
call fcn.004b1340
add esp, 0xc
test eax, eax
je 0x498ced
mov edi, str.POST
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.POST
push esi
call fcn.004b1340
add esp, 0xc
test eax, eax
jne 0x4991a0
mov byte [esp + 0x13], 1
mov dl, byte [esi]
push edx
call fcn.00498990
add esp, 4
test al, al
je 0x4991a0
mov al, byte [esi]
mov byte [esp + 0xa0], al
mov ecx, dword [esp + 0xa0]
push ecx
push 1
lea ecx, [esp + 0x24]
call fcn.004a18a0
cmp byte [esi], 0xa
jne 0x499198
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x498d37
mov eax, 0x4ea894
push eax
lea ecx, [esp + 0x18]
call fcn.004d489b
push 0x5188e8
push 0x509cc8
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd0], 8
call fcn.004d31b9
mov edi, str.GET
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.GET
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x498ddd
push 0x5188e8
push str.HTTP_1.1
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x512ca0
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x50a2e0
lea ecx, [esp + 0x1c]
call fcn.004d31b9
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x58]
call fcn.00406da0
inc ebx
jmp 0x49913d
mov edi, str.POST
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.POST
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x498e26
push 0x5188e8
push str.HTTP_1.1
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x509be8
jmp 0x498da0
mov edi, str.Referer:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Referer:
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x498e96
push 0x5188e8
push 0x512c88
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x50a2e0
lea ecx, [esp + 0x1c]
call fcn.004d31b9
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x74]
call fcn.00406da0
add ebx, 0xa
jmp 0x49913d
mov edi, str.Host:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Host:
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x498fe0
push 0x5188e8
push 0x512c78
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x50a2e0
lea ecx, [esp + 0x1c]
call fcn.004d31b9
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov esi, edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x34]
push ebp
call fcn.00408590
test al, al
je 0x498f27
mov edi, dword [esp + 0x34]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
call fcn.00408570
push str.192.168.
lea ecx, [esp + 0x18]
call fcn.004d353c
test eax, eax
jge 0x4992b9
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x498f4a
mov eax, 0x4ea894
push eax
lea ecx, [esp + 0x6c]
call fcn.004d489b
lea eax, [esp + 0x68]
lea ecx, [esp + 0xa4]
push eax
push ecx
mov byte [esp + 0xd0], 9
call fcn.004a0a50
add esp, 8
mov ecx, dword [esp + 0xe4]
push eax
mov byte [esp + 0xcc], 0xa
call fcn.004d4966
lea ecx, [esp + 0xa4]
mov byte [esp + 0xc8], 9
call fcn.004d482d
lea ecx, [esp + 0x68]
mov byte [esp + 0xc8], 8
call fcn.004d482d
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x498fb8
mov eax, 0x4ea894
mov esi, dword [esp + 0xe8]
push eax
mov ecx, esi
call fcn.004d49b6
push 0x5188e8
push str.www.
mov ecx, esi
call fcn.004d31b9
add ebx, 0x64
jmp 0x499139
mov edi, str.Agent:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Agent:
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x499012
add ebx, 0x3e8
jmp 0x49913d
mov edi, str.Cookie:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Cookie:
lea ecx, [esp + 0x28]
call fcn.00407000
cmp eax, dword [0x4ea898]
je 0x49913d
push 0x5188e8
push 0x512c48
lea ecx, [esp + 0x1c]
call fcn.004d31b9
push 0x5188e8
push 0x50a2e0
lea ecx, [esp + 0x1c]
call fcn.004d31b9
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov esi, edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x44]
push ebp
call fcn.00408590
test al, al
je 0x4990a5
mov edi, dword [esp + 0x44]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x48], ebp
mov byte [eax + ebp], 0
mov eax, dword [0x512390]
test eax, eax
je 0x49910a
mov edi, dword [esp + 0xe4]
mov esi, dword [0x5192e4]
lea ecx, [esp + 0x64]
push edi
push ecx
mov ecx, 0x5192e0
call fcn.004a3750
mov eax, dword [esp + 0x64]
mov ecx, dword [0x5192e4]
cmp eax, ecx
je 0x4990f2
mov eax, dword [eax + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.004aea96
add esp, 8
test eax, eax
jl 0x4990f2
lea eax, [esp + 0x64]
jmp 0x499106
mov edx, dword [0x5192e4]
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], edx
cmp dword [eax], esi
je 0x499133
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0x40]
push eax
call fcn.0040b160
push ecx
mov ecx, esp
mov dword [esp + 0xc4], esp
push eax
call fcn.004d489b
call fcn.00499510
add esp, 8
add ebx, 0x2710
mov esi, dword [esp + 0x18]
mov edi, 0x5188e8
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x20]
push ebp
call fcn.00408590
test al, al
je 0x499187
mov edi, dword [esp + 0x20]
mov ecx, ebp
mov edx, ecx
mov esi, 0x5188e8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
lea ecx, [esp + 0x14]
mov byte [esp + 0xc8], 7
call fcn.004d482d
cmp ebx, 0x2b67
je 0x4991c1
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 0x60]
inc ecx
inc esi
cmp ecx, eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x18], esi
jl 0x498c92
mov eax, dword [esp + 0x38]
xor esi, esi
cmp eax, esi
je 0x499290
cmp dword [esp + 0x58], esi
je 0x499290
mov ecx, dword [0x513458]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x54]
mov byte [esp + 0xc8], 0xb
cmp ecx, esi
jne 0x4991f8
mov ecx, 0x4ea894
mov eax, dword [esp + 0x34]
cmp eax, esi
jne 0x499205
mov eax, 0x4ea894
push ecx
push eax
push str.http:__
lea edx, [esp + 0x24]
push str._s_s_s
push edx
call fcn.004d38c2
mov edi, dword [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
mov esi, edi
mov ebx, dword [esp + 0xd4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00408590
test al, al
je 0x499263
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], ebp
mov ebx, dword [ebx + 4]
add ebx, ebp
mov byte [ebx], 0
mov ecx, dword [0x4ea898]
lea edx, [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0xdc]
push 0
push edx
call fcn.00406ba0
lea ecx, [esp + 0x18]
mov byte [esp + 0xc8], 7
call fcn.004d482d
xor esi, esi
mov ecx, dword [esp + 0x20]
cmp ecx, esi
je 0x49937f
mov al, byte [ecx - 1]
test al, al
je 0x499375
cmp al, 0xff
je 0x499375
dec al
mov byte [ecx - 1], al
jmp 0x49937f
lea ecx, [esp + 0x14]
mov byte [esp + 0xc8], 7
call fcn.004d482d
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0xcc], 6
call fcn.00407180
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
call fcn.00407180
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
call fcn.00407180
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00407180
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
call fcn.00407180
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
call fcn.00407180
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 0
call fcn.00407180
push 1
lea ecx, [esp + 0xb0]
mov dword [esp + 0xcc], 0xffffffff
call fcn.00407180
mov al, 1
jmp 0x4994ee
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x20], esi
cmp ecx, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
je 0x4993af
mov al, byte [ecx - 1]
test al, al
je 0x4993a5
cmp al, 0xff
je 0x4993a5
dec al
mov byte [ecx - 1], al
jmp 0x4993af
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x44], esi
cmp ecx, esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
je 0x4993e2
mov al, byte [ecx - 1]
test al, al
je 0x4993d8
cmp al, 0xff
je 0x4993d8
dec al
mov byte [ecx - 1], al
jmp 0x4993e2
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x90], esi
cmp ecx, esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
je 0x49941b
mov al, byte [ecx - 1]
test al, al
je 0x499411
cmp al, 0xff
je 0x499411
dec al
mov byte [ecx - 1], al
jmp 0x49941b
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x70], esi
cmp ecx, esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
je 0x49944b
mov al, byte [ecx - 1]
test al, al
je 0x499441
cmp al, 0xff
je 0x499441
dec al
mov byte [ecx - 1], al
jmp 0x49944b
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x34], esi
cmp ecx, esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
je 0x49947b
mov al, byte [ecx - 1]
test al, al
je 0x499471
cmp al, 0xff
je 0x499471
dec al
mov byte [ecx - 1], al
jmp 0x49947b
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x54], esi
cmp ecx, esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
je 0x4994ae
mov al, byte [ecx - 1]
test al, al
je 0x4994a4
cmp al, 0xff
je 0x4994a4
dec al
mov byte [ecx - 1], al
jmp 0x4994ae
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x80], esi
cmp ecx, esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
je 0x4994ea
mov al, byte [ecx - 1]
test al, al
je 0x4994e0
cmp al, 0xff
je 0x4994e0
dec al
mov byte [ecx - 1], al
jmp 0x4994ea
dec ecx
push ecx
call fcn.004d4597
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xbc
ret