Function at 0x409ac0
Capabilities:
Check for time delay via gettickcount
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10008
call fcn.00547f50
mov eax, dword [0x5d6b10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
jne 0x4093bc
push str.file_open_failed_
push 2
call fcn.004097e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], 0xfffffff6
test ecx, ecx
je 0x409585
mov eax, dword [esi + 8]
test eax, eax
je 0x409585
push 5
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005463d8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x48]
push edi
cmp word [eax + 0x22], 0
je 0x40941a
xor edi, edi
cmp dword [eax + 0x24], edi
jbe 0x4093f1
mov edi, edi
mov ecx, esi
call fcn.00409990
cmp eax, 0xffffffff
je 0x40940f
mov ecx, esi
call fcn.00409df0
cmp eax, 2
jne 0x409405
mov eax, dword [esi + 0x48]
inc edi
cmp edi, dword [eax + 0x24]
jb 0x4093d0
mov eax, dword [esi + 0x48]
cmp edi, dword [eax + 0x24]
jb 0x40941a
mov dword [esi + 0x4c], 0xfffffff9
jmp 0x409536
test eax, eax
jne 0x409536
jmp 0x4093f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x409536
cmp byte [esi + 0xc], 0
mov dword [esi + 0x26], 0x544547
jne 0x40953c
push ebx
lea esp, [esp]
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.00409710
mov ecx, dword [esi + 0x48]
mov ebx, eax
mov dword [ebp - 0x10008], ebx
cmp ebx, dword [ecx + 0xc]
jae 0x409461
push dword [esi + 0x20]
call fcn.00548d1d
add esp, 4
test eax, eax
jne 0x409517
mov eax, dword [esi + 0x48]
xor edi, edi
cmp dword [eax + 0x24], edi
jbe 0x4094c4
add ebx, 4
mov edi, edi
mov eax, dword [esi + 0x48]
push 0x10
add eax, 0x28
push eax
push 0
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x4094b1
mov ecx, esi
call fcn.00409df0
cmp eax, 4
je 0x409535
cmp eax, 2
jne 0x4094be
mov eax, dword [esi + 0x48]
inc edi
cmp edi, dword [eax + 0x24]
jb 0x409470
jmp 0x4094be
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x4c], 0xfffffffe
mov ebx, dword [ebp - 0x10008]
mov eax, dword [esi + 0x48]
cmp edi, dword [eax + 0x24]
jae 0x40952e
mov ecx, dword [esi + 4]
mov eax, ebx
cdq
add dword [esi + 0x30], eax
mov dword [esi + 0x4c], 0
adc dword [esi + 0x34], edx
add dword [esi + 0x38], 1
adc dword [esi + 0x3c], 0
test ecx, ecx
je 0x4094fd
mov eax, dword [esi + 8]
test eax, eax
je 0x4094fd
push 2
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0x20]
call fcn.00548cf7
add esp, 4
test eax, eax
jne 0x409535
cmp byte [esi + 0xc], al
je 0x409430
jmp 0x409535
push str.file_read_failed_
push 2
mov ecx, esi
call fcn.004097e0
mov dword [esi + 0x4c], 0xfffffff5
jmp 0x409535
mov dword [esi + 0x4c], 0xfffffff9
pop ebx
cmp byte [esi + 0xc], 0
je 0x40955e
push str.session_was_terminated_by_tftp_server_
push 0x64
mov ecx, esi
mov edi, 5
call fcn.004097e0
cmp dword [esi + 0x4c], 0
jne 0x409563
mov dword [esi + 0x4c], 0xfffffff2
jmp 0x409563
mov edi, 6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 4]
mov dword [esi + 0x58], eax
test ecx, ecx
je 0x409584
mov eax, dword [esi + 8]
test eax, eax
je 0x409584
push edi
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005463d8
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 0x48]
movzx eax, word [eax + 0x20]
cmp eax, 1
je 0x409350
cmp eax, 2
je 0x409ac0
xor eax, eax
ret
push ebp
mov ebp, esp
mov eax, 0x10824
call fcn.00547f50
mov eax, dword [0x5d6b10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10814], 0
cmp dword [esi + 0x20], 0
jne 0x409b36
push str.file_open_failed_
push 2
call fcn.004097e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], 0xfffffff6
test ecx, ecx
je 0x409ddd
mov eax, dword [esi + 8]
test eax, eax
je 0x409ddd
push 5
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005463d8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x48]
cmp word [eax + 0x22], 0
lea eax, [ebp - 0x10814]
je 0x409b55
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00409880
jmp 0x409b64
push 0
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00409760
push ebx
xor ebx, ebx
mov dword [ebp - 0x1081c], 1
push edi
mov dword [esi + 0x26], 0x545550
mov dword [ebp - 0x10818], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x10820], eax
cmp byte [esi + 0xc], bl
jne 0x409d8d
jmp 0x409ba0
mov edx, dword [esi + 0x48]
mov eax, edi
sub eax, dword [ebp - 0x10820]
imul ecx, dword [edx + 0x10], 0x3e8
cmp eax, ecx
jbe 0x409be0
inc ebx
mov dword [ebp - 0x10818], ebx
cmp ebx, dword [edx + 0x24]
jae 0x409d27
push dword [ebp - 0x10814]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.004097b0
mov dword [ebp - 0x10820], edi
lea eax, [ebp - 0x10824]
mov dword [ebp - 0x10824], 0x10
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xfffa
lea eax, [ebp - 0x10810]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
test ebx, ebx
je 0x409d86
cmp ebx, 0xffffffff
jne 0x409c42
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x409d30
add dword [esi + 0x40], 1
adc dword [esi + 0x44], 0
add edi, 0x3e8
jmp 0x409d16
push dword [ebp - 0x10810]
mov edi, dword [sym.imp.WS2_32.dll_ntohs]
call edi
movzx eax, ax
cmp eax, 3
jne 0x409d09
push dword [ebp - 0x1080e]
call edi
cmp ax, word [ebp - 0x1081c]
jne 0x409d0e
push dword [esi + 0x20]
lea edi, [ebx - 4]
push edi
lea eax, [ebp - 0x1080c]
push 1
push eax
call fcn.0054920a
add esp, 0x10
mov ecx, esi
cmp eax, edi
jl 0x409d47
mov eax, edi
mov edi, dword [ebp - 0x1081c]
cdq
add dword [esi + 0x30], eax
lea eax, [ebp - 0x10814]
push edi
adc dword [esi + 0x34], edx
add dword [esi + 0x38], 1
push eax
adc dword [esi + 0x3c], 0
lea eax, [ebp - 0x804]
push eax
call fcn.00409760
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], 0
test ecx, ecx
je 0x409cde
mov eax, dword [esi + 8]
test eax, eax
je 0x409cde
push 2
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x48]
cmp ebx, dword [eax + 0xc]
jb 0x409d8d
inc edi
mov dword [ebp - 0x10818], 0
mov dword [ebp - 0x1081c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10820], eax
jmp 0x409d0e
cmp eax, 5
je 0x409d59
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp byte [esi + 0xc], 0
jne 0x409d93
mov ebx, dword [ebp - 0x10818]
jmp 0x409ba0
mov dword [esi + 0x4c], 0xfffffff9
jmp 0x409d8d
push str.socket_error
push 0
mov ecx, esi
call fcn.004097e0
mov dword [esi + 0x4c], 0xfffffff3
jmp 0x409d8d
push 0
push 3
call fcn.004097e0
mov dword [esi + 0x4c], 0xfffffff8
jmp 0x409d8d
push dword [ebp - 0x1080e]
call edi
mov word [esi + 0x68], ax
lea eax, [ebp - 0x1080c]
push 0x5db
push eax
lea eax, [esi + 0x6a]
push eax
call fcn.00547740
add esp, 0xc
mov dword [esi + 0x4c], 0xfffffff1
jmp 0x409d8d
mov dword [esi + 0x4c], 0xfffffffb
cmp byte [esi + 0xc], 0
je 0x409db5
push str.session_was_terminated_by_tftp_server_
push 0
mov ecx, esi
mov edi, 5
call fcn.004097e0
cmp dword [esi + 0x4c], 0
jne 0x409dba
mov dword [esi + 0x4c], 0xfffffff2
jmp 0x409dba
mov edi, 6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 4]
mov dword [esi + 0x58], eax
test ecx, ecx
je 0x409ddb
mov eax, dword [esi + 8]
test eax, eax
je 0x409ddb
push edi
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005463d8
mov esp, ebp
pop ebp
ret