Function at 0x401f00
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x210
lea eax, [esp + 0x110]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
push edi
push 0x100
push eax
lea ebp, [esi + 0xf0]
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x401f7f
lea ecx, [esp + 0x120]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x401f83
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x401f83
mov ecx, dword [ebx]
xor edi, edi
test ecx, ecx
je 0x401f72
mov esi, dword [esi + 0x10]
mov edx, dword [0x41a728]
and esi, edx
mov edx, ebx
mov ecx, dword [ecx]
and ecx, dword [0x41a728]
cmp ecx, esi
je 0x401f72
mov ecx, dword [edx + 4]
add edx, 4
inc edi
test ecx, ecx
jne 0x401f5b
mov ebx, dword [ebx + edi*4]
test ebx, ebx
je 0x401f87
mov dword [esp + 0x14], ebx
jmp 0x401f9e
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x401f96
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dword [esp + 0x14], eax
jmp 0x401f9e
mov dword [esp + 0x14], 0x4150f0
test byte [0x416b64], 1
je 0x401fb7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x224]
mov edx, dword [ecx]
mov dword [eax + 0x14], edx
mov ebx, 0x4150fc
mov dword [esp + 0x10], ebx
cmp byte [ebx], 0
je 0x401fd2
mov cl, byte [ebx - 4]
mov byte [ebp], cl
mov dl, byte [ebx]
inc ebp
mov byte [ebp], dl
inc ebp
mov eax, dword [ebx - 4]
dec eax
cmp eax, 0xfe
ja case.0x401fe9.13
xor ecx, ecx
mov cl, byte [eax + 0x4022b0]
jmp dword [ecx*4 + 0x40227c]
mov dl, byte [esp + 0x228]
mov byte [ebp], dl
jmp case.0x401fe9.13
test byte [0x416b64], 8
je case.0x401fe9.13
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [ebp], ecx
jmp case.0x401fe9.13
mov edx, dword [0x41a728]
mov dword [ebp], edx
jmp case.0x401fe9.13
mov eax, dword [0x41a730]
mov dword [ebp], eax
jmp case.0x401fe9.13
mov ecx, dword [0x41a72c]
mov dword [ebp], ecx
jmp case.0x401fe9.13
mov eax, dword [0x41a874]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
shl edx, 2
push edx
call sub.WSOCK32.dll_htonl
mov dword [ebp], eax
jmp case.0x401fe9.13
mov eax, dword [0x41a874]
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 2
push eax
call sub.WSOCK32.dll_htonl
mov dword [ebp], eax
jmp case.0x401fe9.13
push 0
push 0x80
push 3
push 0
push 1
push bind
push 0x41a734
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x401fe9.13
mov byte [ebp], 0xd
inc ebp
push 0
push esi
mov byte [ebp], 2
inc ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
shr eax, 9
inc eax
push eax
call sub.WSOCK32.dll_htons
mov word [ebp], ax
push esi
add ebp, 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x401fe9.13
mov al, byte [0x41a834]
test al, al
je case.0x401fe9.13
mov byte [ebp], 0xf
push 0x41a834
inc ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
mov esi, 0x41a834
and ecx, 0xff
lea edi, [ebp + 1]
mov edx, ecx
mov byte [ebp], al
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebp]
lea ebp, [eax + ebp + 1]
jmp case.0x401fe9.13
xor eax, eax
mov dword [esp + 0x18], eax
mov ecx, dword [eax + 0x41a878]
lea esi, [eax + 0x41a87c]
test ecx, ecx
je 0x40222b
lea edx, [esp + 0x1c]
mov byte [ebp], cl
push edx
push str.0x_X
push esi
inc ebp
call fcn.0040b5c0
add esp, 0xc
test eax, eax
jle 0x402169
mov byte [ebp], 4
mov eax, dword [esp + 0x1c]
mov dword [ebp + 1], eax
jmp 0x40221e
push str._IP_
push esi
call fcn.0040b540
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4021f7
mov edx, dword [esp + 0x18]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, ebx
sub ecx, edx
lea edx, [esp + 0x20]
sub ecx, 0x41a87c
inc ecx
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esp + 0x224]
mov ecx, dword [eax + 0x10]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x20]
push eax
push edx
call esi
add ebx, 4
lea eax, [esp + 0x20]
push ebx
push eax
call esi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea esi, [esp + 0x20]
and ecx, 0xff
lea edi, [ebp + 1]
mov edx, ecx
mov byte [ebp], al
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x402215
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
mov byte [ebp], al
and ecx, 0xff
lea edi, [ebp + 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov cl, byte [ebp]
lea ebp, [ecx + ebp + 1]
add eax, 0x44
cmp eax, 0x2a8
mov dword [esp + 0x18], eax
jb 0x40212a
jmp case.0x401fe9.13
mov byte [ebp], 0xff
inc ebp
mov byte [ebp], 0
inc ebp
mov byte [ebp], 0
inc ebp
movsx edx, byte [ebx]
add ebx, 5
add ebp, edx
cmp ebx, 0x415142
mov dword [esp + 0x10], ebx
jb 0x401fc0
mov ecx, dword [esp + 0x224]
pop edi
mov eax, ebp
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x210
ret