joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f44d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x75a3e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CParticleManager.0
xor ebx, ebx
lea edi, [esi + 0x10]
mov eax, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 8
or eax, 0xffffffff
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov ecx, dword [0x86fb70]
push ebx
push ebx
mov dword [0x9a71bc], esi
mov eax, dword [ecx]
push 0xc00
mov dword [esp + 0x28], ebx
call dword [eax + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x7c], ebx
mov eax, 0x14
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov eax, 0x2d
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [edi], 6
mov dword [edi + 4], 0x1e
mov dword [esi + 0x1c], 0x18
mov eax, 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], 2
mov dword [esi + 0x24], 0x12
mov dword [esi + 0x28], 3
mov dword [esi + 0x2c], 5
mov ecx, 1
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov byte [esp + 0xc], bl
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.006f4310
mov al, byte [esp + 0xc]
add al, 1
cmp al, 6
mov byte [esp + 0xc], al
jb 0x6f45d6
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x78], bl
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x701cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75a7cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0xffffffffffffffff
push str.easy
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00413870
push 0xffffffffffffffff
push str.normal
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 1
call fcn.00413870
push 0xffffffffffffffff
push str.hard
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 2
call fcn.00413870
mov eax, dword [0x914138]
movzx ecx, byte [eax + 0x360]
mov esi, dword [esp + 0x30]
lea edx, [esp + ecx*8 + 8]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 3
call fcn.00413820
push fcn.00412de0
push 3
push 8
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], 1
mov byte [esp + 0x38], 0
call fcn.0071f0d2
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x713c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x2c]
push ebx
push ebp
xor eax, eax
cmp edx, eax
push esi
push edi
mov esi, ecx
mov dword [esp + 0x24], eax
jge 0x713c47
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + esi + 0xc]
mov dword [esp + 0x3c], ecx
mov edx, ecx
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jge 0x713c62
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + esi + 0x10]
mov dword [esp + 0x10], eax
sub ecx, 1
jmp 0x713c66
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x34]
mov edi, dword [ecx + 8]
mov ebx, edx
shl ebx, 4
mov edi, dword [ebx + edi + 0xc]
mov bp, word [edi + 0xa]
mov edi, dword [esp + 0x40]
cmp edi, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebp
jge 0x713cae
mov edx, dword [ecx + 8]
add edx, ebx
cmp dword [edx], eax
jle 0x713cb9
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0xc]
cmp edx, dword [ecx + 0xc]
jne 0x713cb9
movzx ecx, bp
sub ecx, 1
mov dword [esp + 0x1c], ecx
jmp 0x713ccd
push edi
push edx
call fcn.007126c0
test eax, eax
jne 0x713cc5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10
mov dword [esp + 0x1c], edi
mov eax, edi
mov ecx, edi
cmp eax, ecx
mov ebp, eax
mov dword [esp + 0x40], ebp
jg 0x713d95
shl eax, 9
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
push ebp
push eax
mov ecx, edi
call fcn.007126c0
test eax, eax
je 0x713d7c
mov ecx, dword [edi + 8]
mov edi, dword [ebx + ecx + 0xc]
add edi, dword [esp + 0x18]
je 0x713d7c
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
mov dx, word [esp + 0x28]
movzx ebx, word [edi + 2]
mov ecx, eax
mov word [edi + 0xa], dx
mov dword [esp + 0x38], ecx
jg 0x713d78
mov ebp, eax
lea ebp, [ebp + ebp*2]
add ebp, ebp
add ebp, ebp
sub ebp, eax
add ebp, ebp
add ebp, ebp
cmp ecx, dword [esp + 0x3c]
je 0x713d60
mov eax, dword [esi + 8]
mov eax, dword [eax + ebp]
test eax, eax
je 0x713d60
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push edi
call dword [edx + 0x28]
add dword [esi + 0x78], ebx
test eax, eax
je 0x713d60
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x38]
add ecx, 1
add ebp, 0x2c
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
jle 0x713d35
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x20]
add dword [esp + 0x18], 0x200
add ebp, 1
cmp ebp, dword [esp + 0x1c]
mov dword [esp + 0x40], ebp
jle 0x713ce2
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
Function at 0x715ee0
Capabilities:
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
mov edx, 0x9aaea0
push edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x715ef2
mov dword [0x9aa678], 0xffffffff
call fcn.00716750
movsx eax, byte [0x9aaee0]
test eax, eax
jne 0x715ff4
push esi
lea eax, [esp + 0xc]
push str._s.available.gamespy.com
push eax
call fcn.007210ab
add esp, 0xc
lea edi, [esp + 8]
push 0x6cfc
mov word [0x9aa67c], 2
call sub.WS2_32.dll_htons
push edi
mov word [0x9aa67e], ax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [0x9aa680], eax
jne 0x715f76
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x715fee
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [0x9aa680], eax
push 0x11
push 2
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [0x9aa678], eax
je 0x715fee
mov eax, esi
mov byte [0x9aa68c], 9
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x715f97
sub eax, edx
lea ecx, [eax + 1]
mov edx, ecx
shr ecx, 2
mov edi, 0x9aa691
rep movsd dword es:[edi], dword [esi]
push 0x10
push 0x9aa67c
mov ecx, edx
add eax, 6
push 0
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov dword [0x9aa6cc], eax
mov eax, dword [0x9aa678]
push 0x9aa68c
push eax
call sub.WS2_32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [0x9aa6d0], eax
mov dword [0x9aa6d4], 0
pop edi
pop esi
add esp, 0x40
ret
mov edi, 0x9aaee0
jmp 0x715f33

Function at 0x716090
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x58
mov eax, dword [0x9aa678]
cmp eax, 0xffffffff
mov dword [esp], 0x10
je 0x716149
push eax
call fcn.007167d0
add esp, 4
test eax, eax
je 0x71611f
lea eax, [esp]
push eax
mov eax, dword [0x9aa678]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x40
lea edx, [esp + 0x28]
push edx
push eax
call sub.WS2_32.dll_recvfrom
lea ecx, [esp + 4]
push ecx
push eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x20]
call fcn.00716020
add esp, 8
test eax, eax
jne 0x71611f
mov edx, dword [0x9aa678]
push edx
call sub.WS2_32.dll_closesocket
mov al, byte [esp + 4]
test al, 1
je 0x71610e
mov eax, 2
mov dword [0x9aae80], eax
add esp, 0x58
ret
movsx eax, al
and eax, 2
or al, 1
mov dword [0x9aae80], eax
add esp, 0x58
ret
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [0x9aa6d0]
add ecx, 0x7d0
cmp eax, ecx
jbe 0x716168
cmp dword [0x9aa6d4], 1
jne 0x71615c
mov edx, dword [0x9aa678]
push edx
call sub.WS2_32.dll_closesocket
mov dword [0x9aae80], 1
mov eax, 1
add esp, 0x58
ret
call fcn.00715eb0
add dword [0x9aa6d4], 1
xor eax, eax
add esp, 0x58
ret

Function at 0x716750
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x7167d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 8]
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 1
call sub.WS2_32.dll_select
mov esi, eax
cmp esi, 0xffffffff
je 0x716838
test esi, esi
jle 0x716831
lea edx, [esp + 0x10]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x716831
mov eax, 1
jmp 0x716833
xor eax, eax
cmp esi, 1
je 0x71683a
xor eax, eax
pop edi
pop esi
add esp, 0x10c
ret

Function at 0x716850
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x3f
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x100
lea eax, [esp + 0xc]
push eax
call sub.WS2_32.dll_gethostname
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x716fa0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov edi, eax
xor eax, eax
lea ecx, [esp + 0x14]
mov byte [ecx], al
add eax, 1
add ecx, 1
cmp ax, 0x100
jl 0x716fb2
xor dl, dl
xor eax, eax
lea ecx, [esp + 0x14]
mov esi, 0x100
lea ecx, [ecx]
mov ebx, dword [esp + 0x118]
movzx ebp, byte [ecx]
movzx edx, dl
movzx ebx, byte [edx + ebx]
add ebx, eax
add ebx, ebp
and ebx, 0x800000ff
jns 0x716ff5
dec ebx
or ebx, 0xffffff00
inc ebx
lea eax, [edx + 1]
cdq
idiv edi
movzx eax, bl
movzx ebx, byte [ecx]
mov byte [esp + 0x13], bl
movzx ebx, byte [esp + eax + 0x14]
mov byte [ecx], bl
movzx ebx, byte [esp + 0x13]
add ecx, 1
sub esi, 1
mov byte [esp + eax + 0x14], bl
jne 0x716fd0
xor ebp, ebp
cmp dword [esp + 0x120], ebp
jle 0x7170c3
xor esi, esi
xor edi, edi
xor eax, eax
mov ecx, dword [esp + 0x11c]
mov dl, byte [eax + ecx]
movzx ecx, dl
lea ecx, [ecx + esi + 1]
and ecx, 0x800000ff
jns 0x717053
dec ecx
or ecx, 0xffffff00
inc ecx
movzx esi, cl
movzx ecx, byte [esp + esi + 0x14]
add ecx, edi
and ecx, 0x800000ff
jns 0x71706d
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edi, cl
mov bl, byte [esp + edi + 0x14]
mov cl, byte [esp + esi + 0x14]
mov byte [esp + esi + 0x14], bl
mov byte [esp + edi + 0x14], cl
movzx ecx, byte [esp + esi + 0x14]
movzx ebx, byte [esp + edi + 0x14]
add ecx, ebx
and ecx, 0x800000ff
jns 0x71709c
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x14]
xor cl, dl
mov edx, dword [esp + 0x11c]
add ebp, 1
mov byte [eax + edx], cl
movsx eax, bp
cmp eax, dword [esp + 0x120]
jl 0x717032
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x717bc0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x804
mov eax, dword [esi + 0x84]
push 0x10
lea ecx, [esi + 0xcc]
push ecx
push 0
push 5
lea edx, [esp + 0x10]
mov dword [esp + 0x11], eax
mov eax, dword [esi]
push edx
push eax
mov byte [esp + 0x18], 8
mov dword [esp + 0x818], 5
call sub.WS2_32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xb0], eax
add esp, 0x804
ret
Function at 0x717e80
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [eax]
push esi
call fcn.00716750
push 0x11
push 2
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x717eb1
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret
lea eax, [ebx + 0x64]
cmp ebx, eax
push ebp
push edi
mov dword [esp + 0x14], eax
jge 0x717f69
mov ebp, dword [esp + 0x34]
jmp 0x717ed0
push ebx
mov word [esp + 0x20], 2
call sub.WS2_32.dll_htons
test ebp, ebp
mov word [esp + 0x1e], ax
jne 0x717eec
mov dword [esp + 0x20], ebp
jmp 0x717f26
push ebp
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x717f26
mov edi, str.255.255.255.255
mov esi, ebp
mov ecx, 0x10
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x717f22
push ebp
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x717f22
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
mov esi, dword [esp + 0x10]
push 0x7f000001
call sub.WS2_32.dll_htonl
cmp dword [esp + 0x20], eax
jne 0x717f3e
mov dword [esp + 0x20], 0
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call sub.WS2_32.dll_bind
test eax, eax
je 0x717f69
add ebx, 1
cmp ebx, dword [esp + 0x14]
jl 0x717ed0
pop edi
pop ebp
pop esi
mov eax, 2
pop ebx
add esp, 0x1c
ret
test ebx, ebx
jne 0x717f96
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x24], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x717f5c
mov eax, dword [esp + 0x1e]
push eax
call sub.WS2_32.dll_ntohs
movzx ebx, ax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
pop edi
pop ebp
mov dword [ecx], esi
pop esi
mov dword [edx], ebx
xor eax, eax
pop ebx
add esp, 0x1c
ret

Function at 0x718110
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
cmp dword [esi + 0xc4], 0
mov dword [esp], 0x10
je 0x71817e
mov eax, dword [esi]
push eax
call fcn.007167d0
add esp, 4
test eax, eax
je 0x71817e
mov eax, dword [esi]
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0xff
push 0x9aa808
push eax
call sub.WS2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x71816f
lea ecx, [esp + 4]
push ecx
push eax
push 0x9aa808
push esi
mov byte [eax + 0x9aa808], 0
call fcn.00717940
add esp, 0x10
mov edx, dword [esi]
push edx
call fcn.007167d0
add esp, 4
test eax, eax
jne 0x718132
add esp, 0x14
ret
Function at 0x718da0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [ebx + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
je 0x718dbb
mov dword [eax + 0x20], esi
mov dword [ebx + 0xc], esi
mov dword [esi + 0x20], 0
cmp dword [ebx + 8], 0
jne 0x718dce
mov dword [ebx + 8], esi
add dword [ebx + 0x10], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x1c], eax
cmp dword [ebx], 1
jne 0x718e45
test byte [esi + 0x14], 4
mov byte [esp + 0x18], 0xfe
mov byte [esp + 0x19], 0xfd
mov byte [esp + 0x1a], 0
mov dword [esp + 0x1b], eax
je 0x718e30
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
mov al, byte [ebx + 0x3c]
mov byte [esp + 0x1f], al
jle 0x718e1e
mov edx, ecx
shr ecx, 2
lea esi, [ebx + 0x28]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov byte [esp + eax + 0x20], 0
mov byte [esp + eax + 0x21], 0
lea ecx, [eax + 0xa]
jmp 0x718e91
mov al, 0xff
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov ecx, 0xa
jmp 0x718e91
test byte [esi + 0x14], 4
je 0x718e78
mov eax, dword [str._basicinfo_]
mov ecx, dword [0x803df8]
mov edx, dword [0x803dfc]
mov dword [esp + 0x18], eax
mov al, byte [0x803e00]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x24], al
mov ecx, 0xd
jmp 0x718e91
mov ecx, dword [str._status_]
mov edx, dword [0x803dec]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ecx, 8
mov eax, dword [esi]
cmp eax, dword [ebx + 0x24]
mov edx, 2
mov word [esp + 8], dx
jne 0x718eb9
test byte [esi + 0x15], dl
je 0x718eb9
mov eax, dword [esi + 8]
mov dx, word [esi + 0xc]
mov dword [esp + 0xc], eax
mov word [esp + 0xa], dx
jmp 0x718ec6
mov dword [esp + 0xc], eax
mov ax, word [esi + 4]
mov word [esp + 0xa], ax
push 0x10
lea edx, [esp + 0xc]
push edx
push 0
push ecx
mov ecx, dword [ebx + 0x20]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.WS2_32.dll_sendto
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x718ef0
Capabilities:
Create udp socket

Disassembly:
cmp dword [0x9aae80], 1
jne 0x718f49
push esi
push edi
call fcn.00716750
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 0x11
mov dword [esi], eax
mov eax, dword [esp + 0x20]
xor edi, edi
push 2
push 2
mov dword [esi + 4], ecx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], eax
mov dword [esi + 0x24], edi
call sub.WS2_32.dll_socket
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
pop edi
pop esi
ret
Function at 0x719130
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x814
mov eax, dword [edi + 0x20]
push eax
mov dword [esp + 4], 0x10
call fcn.007167d0
add esp, 4
test eax, eax
je 0x719256
push ebx
push ebp
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [edi + 0x20]
lea edx, [esp + 0x14]
push edx
push 0
push 0x7ff
lea eax, [esp + 0x30]
push eax
push ecx
call sub.WS2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x719253
mov ebx, dword [edi + 8]
test ebx, ebx
lea ebp, [edi + 8]
mov byte [esp + eax + 0x20], 0
je 0x71923f
mov si, word [esp + 0x12]
mov edx, dword [esp + 0x14]
lea esp, [esp]
mov ecx, dword [ebx]
cmp ecx, edx
jne 0x7191ac
cmp word [ebx + 4], si
je 0x7191cb
cmp ecx, dword [edi + 0x24]
jne 0x7191c2
test byte [ebx + 0x15], 2
je 0x7191c2
cmp dword [ebx + 8], edx
jne 0x7191c2
cmp word [ebx + 0xc], si
je 0x7191cb
mov ebx, dword [ebx + 0x20]
test ebx, ebx
jne 0x7191a0
jmp 0x71923f
cmp dword [edi], 1
jne 0x7191e0
push eax
push edi
lea eax, [esp + 0x28]
call fcn.00719030
add esp, 8
jmp 0x71923f
lea edx, [esp + 0x20]
push str._final_
push edx
call fcn.00721460
mov esi, eax
lea eax, [esp + 0x28]
neg esi
push eax
sbb esi, esi
push ebx
neg esi
call fcn.007196d0
add esp, 0x10
test esi, esi
je 0x71923f
mov al, byte [ebx + 0x14]
test al, 4
je 0x719214
or al, 1
jmp 0x719216
or al, 2
mov byte [ebx + 0x14], al
and byte [ebx + 0x14], 0xf3
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebx + 0x1c]
mov edx, ebp
mov dword [ebx + 0x1c], eax
mov eax, ebx
call fcn.00718d50
mov ecx, dword [edi + 0x44]
push ecx
push ebx
push 0
push edi
call dword [edi + 0x40]
add esp, 0x10
mov edx, dword [edi + 0x20]
push edx
call fcn.007167d0
add esp, 4
test eax, eax
jne 0x719155
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
Function at 0x71a4a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x90
push esi
lea esi, [edi + 0xc]
push 0x14
mov eax, esi
call fcn.0071a460
mov ecx, eax
mov eax, dword [0x9aa91c]
add esp, 4
test eax, eax
je 0x71a4d5
lea edx, [esp + 0x14]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x71a4c7
jmp 0x71a4e9
push ecx
push esi
lea eax, [esp + 0x1c]
push str._s.ms_d.gamespy.com
push eax
call fcn.007210ab
add esp, 0x10
push 0x70ee
mov word [esp + 8], 2
call sub.WS2_32.dll_htons
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0xa], ax
call sub.WS2_32.dll_inet_addr
or esi, 0xffffffff
cmp eax, esi
mov dword [esp + 8], eax
jne 0x71a53a
lea edx, [esp + 0x14]
push edx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x71a52f
mov eax, 2
pop esi
add esp, 0x90
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
cmp dword [edi + 0x4ac], esi
jne 0x71a564
push 6
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, esi
mov dword [edi + 0x4ac], eax
jne 0x71a564
mov eax, 1
pop esi
add esp, 0x90
ret
mov ecx, dword [edi + 0x4ac]
push 0x10
lea eax, [esp + 8]
push eax
push ecx
call sub.WS2_32.dll_connect
test eax, eax
je 0x71a59a
mov edx, dword [edi + 0x4ac]
push edx
call sub.WS2_32.dll_closesocket
mov dword [edi + 0x4ac], esi
mov eax, 3
pop esi
add esp, 0x90
ret
xor eax, eax
pop esi
add esp, 0x90
ret

Function at 0x71b4a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x5f4
mov eax, dword [esi + 0x4ac]
push edi
push eax
mov dword [esp + 0xc], 0x10
call fcn.007167d0
add esp, 4
test eax, eax
je 0x71b57b
jmp 0x71b4d0
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x4ac]
lea edx, [esp + 0x10]
push edx
push 0
push 0x5db
lea eax, [esp + 0x2c]
push eax
push ecx
call sub.WS2_32.dll_recvfrom
cmp eax, 0xffffffff
je 0x71b564
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
call fcn.0071a170
add esp, 0xc
cmp eax, 0xffffffff
jne 0x71b564
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0x10]
push ecx
push edx
push esi
call fcn.007199d0
mov edi, eax
push edi
call fcn.00719aa0
add esp, 0x10
test eax, eax
jne 0x71b5cd
push 0x11
push edi
call fcn.00719a40
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], edi
call fcn.00716510
mov edx, dword [esi + 0x48c]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push esi
call dword [esi + 0x480]
add esp, 0x20
mov ecx, dword [esi + 0x4ac]
push ecx
call fcn.007167d0
add esp, 4
test eax, eax
jne 0x71b4d0
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esi + 0x4b0]
cmp eax, 0x7d0
jbe 0x71b5c3
mov edx, dword [esi + 0x4ac]
push edx
call sub.WS2_32.dll_closesocket
mov eax, dword [esi + 0x48c]
push eax
mov dword [esi + 0x4ac], 0xffffffff
mov dword [esi], 1
mov ecx, dword [0x9aa914]
push ecx
push 3
push esi
call dword [esi + 0x480]
add esp, 0x10
xor eax, eax
pop edi
add esp, 0x5f4
ret
mov eax, 5
pop edi
add esp, 0x5f4
ret
Function at 0x71b5e0
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x9aae80], 1
jne 0x71b6f7
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push ebx
push 0x64
push 4
mov dword [esi], 1
call fcn.00716170
push esi
mov dword [esi + 4], eax
mov dword [esi + 0x5cc], ebx
call fcn.00719ad0
mov eax, dword [esp + 0x20]
lea edx, [esi + 0xc]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x71b620
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x2c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x71b635
mov eax, dword [esp + 0x18]
lea edx, [esi + 0x4c]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x71b650
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x480], eax
or eax, 0xffffffff
mov dword [esi + 0x48c], ecx
mov ecx, 0x7ee39c
mov dword [esi + 0x4ac], eax
mov dword [esi + 0x47c], eax
xor eax, eax
cmp eax, ecx
mov dword [esi + 0x484], ebx
mov dword [esi + 0x490], ecx
mov dword [esi + 0x498], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x478], ebx
mov dword [esi + 0x49c], ebx
mov dword [esi + 0x4b4], edx
mov dword [esi + 0x4a4], ebx
mov dword [esi + 0x4a8], ebx
je 0x71b6dc
push ecx
mov dword [esi + 0x4a4], ecx
call fcn.00716d00
add esp, 4
mov dword [esi + 0x4a8], eax
mov dword [esi + 0x5c8], ebx
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.0072019d
add esp, 4
pop esi
pop ebx
jmp fcn.00716750
ret