Function at 0x497c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4e512f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
mov al, byte [esp + 3]
push ebx
push ebp
push esi
push edi
push 0
lea ecx, [esp + 0xb0]
mov byte [esp + 0xb0], al
call fcn.00406ab0
mov edi, 0x517348
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x517348
lea ecx, [esp + 0xb4]
call fcn.00406740
mov cl, byte [esp + 0x13]
push 0
mov byte [esp + 0x80], cl
lea ecx, [esp + 0x80]
mov dword [esp + 0xcc], 0
call fcn.00406ab0
mov edi, 0x517348
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x517348
lea ecx, [esp + 0x84]
call fcn.00406740
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
mov byte [esp + 0x54], dl
call fcn.00406ab0
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
mov byte [esp + 0x34], al
call fcn.00406ab0
mov cl, byte [esp + 0x13]
push 0
mov byte [esp + 0x70], cl
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00406ab0
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
mov byte [esp + 0x90], dl
call fcn.00406ab0
mov al, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
mov byte [esp + 0x44], al
call fcn.00406ab0
mov ebp, dword [esp + 0xd0]
mov byte [esp + 0xc8], 6
mov cx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov bx, ax
mov al, byte [ebp + 0xe]
and ebx, 0xffff
test al, al
je 0x497dc6
xor edx, edx
mov byte [esp + 0x13], 0
mov dl, byte [ebx + ebp + 0x1a]
mov al, byte [esp + 0x13]
mov esi, edx
push 0
shr esi, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
shl esi, 2
call fcn.00406ab0
mov edi, 0x517348
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x517348
lea ecx, [esp + 0x24]
call fcn.00406740
sub ebx, esi
mov byte [esp + 0xc8], 7
test ebx, ebx
lea ebp, [esi + ebp + 0xe]
mov dword [esp + 0x2c], ebx
jg 0x497e5e
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0xcc], 6
call fcn.00406ab0
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
call fcn.00406ab0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
call fcn.00406ab0
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00406ab0
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
call fcn.00406ab0
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
call fcn.00406ab0
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 0
call fcn.00406ab0
push 1
lea ecx, [esp + 0xb0]
mov dword [esp + 0xcc], 0xffffffff
call fcn.00406ab0
xor al, al
jmp 0x49870e
cmp ebx, 0xbb8
jle 0x497e6e
mov dword [esp + 0x2c], 0xbb8
mov edi, 0x517348
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x517348
lea ecx, [esp + 0x38]
call fcn.00406740
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x60], ebx
cmp eax, ebx
jle 0x4983e1
mov edi, 3
mov esi, ebp
sub edi, ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0xa8], edi
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x497f12
lea ecx, [edi + esi]
cmp ecx, eax
jge 0x4983cb
mov edi, str.GET
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.GET
push esi
call fcn.004b03d0
add esp, 0xc
test eax, eax
je 0x497f0d
mov edi, str.POST
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.POST
push esi
call fcn.004b03d0
add esp, 0xc
test eax, eax
jne 0x4983c0
mov byte [esp + 0x13], 1
mov dl, byte [esi]
push edx
call fcn.00497bb0
add esp, 4
test al, al
je 0x4983c0
mov al, byte [esi]
mov byte [esp + 0xa0], al
mov ecx, dword [esp + 0xa0]
push ecx
push 1
lea ecx, [esp + 0x24]
call fcn.004a0950
cmp byte [esi], 0xa
jne 0x4983b8
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x497f57
mov eax, 0x4e9894
push eax
lea ecx, [esp + 0x18]
call fcn.004d38eb
push 0x517348
push 0x508b64
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd0], 8
call fcn.004d2209
mov edi, str.GET
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.GET
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x497ffd
push 0x517348
push str.HTTP_1.1
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x511774
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x509164
lea ecx, [esp + 0x1c]
call fcn.004d2209
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x58]
call fcn.00406740
inc ebx
jmp 0x49835d
mov edi, str.POST
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.POST
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x498046
push 0x517348
push str.HTTP_1.1
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x508a64
jmp 0x497fc0
mov edi, str.Referer:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Referer:
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x4980b6
push 0x517348
push 0x51175c
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x509164
lea ecx, [esp + 0x1c]
call fcn.004d2209
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x74]
call fcn.00406740
add ebx, 0xa
jmp 0x49835d
mov edi, str.Host:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Host:
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x498200
push 0x517348
push 0x51174c
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x509164
lea ecx, [esp + 0x1c]
call fcn.004d2209
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov esi, edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x34]
push ebp
call fcn.00407ec0
test al, al
je 0x498147
mov edi, dword [esp + 0x34]
mov ecx, ebp
mov edx, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
call fcn.00407ea0
push str.192.168.
lea ecx, [esp + 0x18]
call fcn.004d258c
test eax, eax
jge 0x4984d9
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x49816a
mov eax, 0x4e9894
push eax
lea ecx, [esp + 0x6c]
call fcn.004d38eb
lea eax, [esp + 0x68]
lea ecx, [esp + 0xa4]
push eax
push ecx
mov byte [esp + 0xd0], 9
call fcn.0049fb00
add esp, 8
mov ecx, dword [esp + 0xe4]
push eax
mov byte [esp + 0xcc], 0xa
call fcn.004d39b6
lea ecx, [esp + 0xa4]
mov byte [esp + 0xc8], 9
call fcn.004d387d
lea ecx, [esp + 0x68]
mov byte [esp + 0xc8], 8
call fcn.004d387d
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4981d8
mov eax, 0x4e9894
mov esi, dword [esp + 0xe8]
push eax
mov ecx, esi
call fcn.004d3a06
push 0x517348
push str.www.
mov ecx, esi
call fcn.004d2209
add ebx, 0x64
jmp 0x498359
mov edi, str.Agent:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Agent:
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x498232
add ebx, 0x3e8
jmp 0x49835d
mov edi, str.Cookie:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push eax
push str.Cookie:
lea ecx, [esp + 0x28]
call fcn.004069a0
cmp eax, dword [0x4e9898]
je 0x49835d
push 0x517348
push 0x51171c
lea ecx, [esp + 0x1c]
call fcn.004d2209
push 0x517348
push 0x509164
lea ecx, [esp + 0x1c]
call fcn.004d2209
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov esi, edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x44]
push ebp
call fcn.00407ec0
test al, al
je 0x4982c5
mov edi, dword [esp + 0x44]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x48], ebp
mov byte [eax + ebp], 0
mov eax, dword [0x510e64]
test eax, eax
je 0x49832a
mov edi, dword [esp + 0xe4]
mov esi, dword [0x517cfc]
lea ecx, [esp + 0x64]
push edi
push ecx
mov ecx, 0x517cf8
call fcn.004a2820
mov eax, dword [esp + 0x64]
mov ecx, dword [0x517cfc]
cmp eax, ecx
je 0x498312
mov eax, dword [eax + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.004adbb0
add esp, 8
test eax, eax
jl 0x498312
lea eax, [esp + 0x64]
jmp 0x498326
mov edx, dword [0x517cfc]
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], edx
cmp dword [eax], esi
je 0x498353
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0x40]
push eax
call fcn.0040a850
push ecx
mov ecx, esp
mov dword [esp + 0xc4], esp
push eax
call fcn.004d38eb
call fcn.00498730
add esp, 8
add ebx, 0x2710
mov esi, dword [esp + 0x18]
mov edi, 0x517348
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x20]
push ebp
call fcn.00407ec0
test al, al
je 0x4983a7
mov edi, dword [esp + 0x20]
mov ecx, ebp
mov edx, ecx
mov esi, 0x517348
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov byte [eax + ebp], 0
lea ecx, [esp + 0x14]
mov byte [esp + 0xc8], 7
call fcn.004d387d
cmp ebx, 0x2b67
je 0x4983e1
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 0x60]
inc ecx
inc esi
cmp ecx, eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x18], esi
jl 0x497eb2
mov eax, dword [esp + 0x38]
xor esi, esi
cmp eax, esi
je 0x4984b0
cmp dword [esp + 0x58], esi
je 0x4984b0
mov ecx, dword [0x511ed0]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x54]
mov byte [esp + 0xc8], 0xb
cmp ecx, esi
jne 0x498418
mov ecx, 0x4e9894
mov eax, dword [esp + 0x34]
cmp eax, esi
jne 0x498425
mov eax, 0x4e9894
push ecx
push eax
push str.http:__
lea edx, [esp + 0x24]
push str._s_s_s
push edx
call fcn.004d2912
mov edi, dword [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
mov esi, edi
mov ebx, dword [esp + 0xd4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00407ec0
test al, al
je 0x498483
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], ebp
mov ebx, dword [ebx + 4]
add ebx, ebp
mov byte [ebx], 0
mov ecx, dword [0x4e9898]
lea edx, [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0xdc]
push 0
push edx
call fcn.00406540
lea ecx, [esp + 0x18]
mov byte [esp + 0xc8], 7
call fcn.004d387d
xor esi, esi
mov ecx, dword [esp + 0x20]
cmp ecx, esi
je 0x49859f
mov al, byte [ecx - 1]
test al, al
je 0x498595
cmp al, 0xff
je 0x498595
dec al
mov byte [ecx - 1], al
jmp 0x49859f
lea ecx, [esp + 0x14]
mov byte [esp + 0xc8], 7
call fcn.004d387d
push 1
lea ecx, [esp + 0x20]
mov byte [esp + 0xcc], 6
call fcn.00406ab0
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0xcc], 5
call fcn.00406ab0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0xcc], 4
call fcn.00406ab0
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 3
call fcn.00406ab0
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 2
call fcn.00406ab0
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xcc], 1
call fcn.00406ab0
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 0
call fcn.00406ab0
push 1
lea ecx, [esp + 0xb0]
mov dword [esp + 0xcc], 0xffffffff
call fcn.00406ab0
mov al, 1
jmp 0x49870e
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x20], esi
cmp ecx, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
je 0x4985cf
mov al, byte [ecx - 1]
test al, al
je 0x4985c5
cmp al, 0xff
je 0x4985c5
dec al
mov byte [ecx - 1], al
jmp 0x4985cf
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x44], esi
cmp ecx, esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
je 0x498602
mov al, byte [ecx - 1]
test al, al
je 0x4985f8
cmp al, 0xff
je 0x4985f8
dec al
mov byte [ecx - 1], al
jmp 0x498602
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x90], esi
cmp ecx, esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
je 0x49863b
mov al, byte [ecx - 1]
test al, al
je 0x498631
cmp al, 0xff
je 0x498631
dec al
mov byte [ecx - 1], al
jmp 0x49863b
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x70], esi
cmp ecx, esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
je 0x49866b
mov al, byte [ecx - 1]
test al, al
je 0x498661
cmp al, 0xff
je 0x498661
dec al
mov byte [ecx - 1], al
jmp 0x49866b
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x34], esi
cmp ecx, esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
je 0x49869b
mov al, byte [ecx - 1]
test al, al
je 0x498691
cmp al, 0xff
je 0x498691
dec al
mov byte [ecx - 1], al
jmp 0x49869b
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x54], esi
cmp ecx, esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
je 0x4986ce
mov al, byte [ecx - 1]
test al, al
je 0x4986c4
cmp al, 0xff
je 0x4986c4
dec al
mov byte [ecx - 1], al
jmp 0x4986ce
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x80], esi
cmp ecx, esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
je 0x49870a
mov al, byte [ecx - 1]
test al, al
je 0x498700
cmp al, 0xff
je 0x498700
dec al
mov byte [ecx - 1], al
jmp 0x49870a
dec ecx
push ecx
call fcn.004d35e7
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xbc
ret