Function at 0x1006df11
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
sub esp, 0x64
mov eax, 0x100a4cb9
call fcn.1007c8b4
sub esp, 0x164
cmp byte [0x100d2da8], 0
push ebx
push esi
push edi
je 0x1006df54
lea ecx, [ebp + 0x67]
call fcn.10064eb7
mov esi, eax
mov ecx, esi
call fcn.100500f6
push dword [ebp + 0x78]
mov edi, dword [ebp + 0x70]
push edi
push esi
push 4
call fcn.100546cc
add esp, 0x10
mov esi, dword [ebp + 0x70]
push 0
push esi
call fcn.100729f5
pop ecx
pop ecx
test al, al
je 0x1006df6f
mov eax, 0x2746
jmp 0x1006e535
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x28], eax
call fcn.1006946a
mov ebx, eax
mov eax, 0x80
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x50], ebx
cmp dword [ebx + 4], 0
je 0x1006e42f
cmp dword [ebx], 0
je 0x1006e42f
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x170]
push eax
push esi
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x1006e11c
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0xf0]
push eax
push esi
call sub.WS2_32.dll_getpeername
test eax, eax
jne 0x1006e11c
push dword [ebp - 0xee]
call sub.WS2_32.dll_ntohs
movzx edi, ax
mov eax, 0x203e
mov dword [ebp + 0x58], edi
cmp di, ax
jne 0x1006dffa
call fcn.10049c98
mov byte [ebp + 0x67], 1
test al, al
jne 0x1006dffe
mov byte [ebp + 0x67], 0
cmp byte [0x100d2da8], 0
je 0x1006e02a
lea ecx, [ebp + 0x66]
call fcn.10063539
mov esi, eax
mov ecx, esi
call fcn.1004a81d
movzx ecx, di
push ecx
push esi
push 4
call fcn.100546cc
mov esi, dword [ebp + 0x70]
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp]
call fcn.10003a4f
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003a4f
call fcn.100499e1
cmp eax, 0xb
jae 0x1006e070
call fcn.1007a7eb
test al, al
jne 0x1006e070
call fcn.10049edf
test al, al
jne 0x1006e070
cmp byte [0x100d369b], al
je 0x1006e123
mov eax, 0x1bb
cmp di, ax
je 0x1006e089
push edi
call fcn.1006a79b
pop ecx
test al, al
je 0x1006e137
lea ecx, [ebp]
call fcn.10003b12
lea ecx, [ebp - 0x70]
movzx ebx, ax
call fcn.100619c8
and dword [ebp - 0x6c], 0
lea eax, [ebp + 0x34]
push eax
lea ecx, [ebp]
mov dword [ebp - 0x70], esi
call fcn.10003afe
push 6
pop ecx
mov esi, eax
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x34]
mov word [ebp - 0x36], bx
push eax
lea ecx, [ebp - 0x28]
call fcn.10003afe
mov ebx, dword [ebp + 0x50]
lea edi, [ebp - 0x68]
push 6
pop ecx
mov esi, eax
lea eax, [ebp - 0x70]
push eax
push 1
push dword [ebx + 4]
rep movsd dword es:[edi], dword [esi]
push dword [ebx]
mov esi, dword [ebp + 0x70]
mov ecx, 0x100d359c
mov edi, dword [ebp + 0x58]
push 0
push esi
mov word [ebp - 0x38], di
call fcn.1004ba60
test al, al
je 0x1006e123
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
push esi
call fcn.10065d36
push dword [ebx]
call fcn.1007c98c
and dword [ebx], 0
add esp, 0x14
and dword [ebx + 4], 0
mov edi, esi
jmp 0x1006e445
mov eax, 0x1bb
cmp ax, di
jne 0x1006e137
cmp dword [ebx + 8], 3
je 0x1006e20a
push edi
call fcn.1006a79b
pop ecx
test al, al
jne 0x1006e20a
cmp dword [ebx + 8], 4
jne 0x1006e176
cmp byte [0x100d34e0], al
jne 0x1006e20a
cmp byte [0x100d369b], al
je 0x1006e169
cmp byte [ebp + 0x67], al
je 0x1006e20a
call fcn.10049eb1
test al, al
jne 0x1006e20a
mov eax, 0x203e
cmp ax, di
jne 0x1006e1d8
call fcn.1005abea
push str.waol.exe
lea ecx, [eax + 0x78]
call fcn.100031fd
test al, al
jne 0x1006e20a
call fcn.1005abea
push str.aolbrowser.exe
lea ecx, [eax + 0x78]
call fcn.100031fd
test al, al
jne 0x1006e20a
call fcn.1005abea
push str.aolhelix.exe
lea ecx, [eax + 0x78]
call fcn.100031fd
test al, al
jne 0x1006e20a
call fcn.1005abea
push str.aoldesktop.exe
lea ecx, [eax + 0x78]
call fcn.100031fd
test al, al
jne 0x1006e20a
mov eax, 0xd4ab
cmp ax, di
je 0x1006e1ec
mov eax, 0x20fb
cmp ax, di
jne 0x1006e1f2
cmp dword [ebx + 8], 3
je 0x1006e20a
mov eax, 0x14e
cmp ax, di
jne 0x1006e442
cmp dword [ebx + 8], 3
jne 0x1006e442
cmp byte [0x100d2da8], 0
je 0x1006e231
lea ecx, [ebp + 0x66]
call fcn.10064bf3
mov esi, eax
mov ecx, esi
call fcn.10016280
push esi
push 4
call fcn.100546cc
mov esi, dword [ebp + 0x70]
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
push esi
call fcn.10065d36
add esp, 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp + 0x3c]
push eax
lea eax, [ebp]
push eax
call fcn.10035f40
and dword [ebp - 4], 0
call fcn.1005abea
add eax, 0x78
cmp dword [eax + 0x14], 0x10
jb 0x1006e267
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x3c]
call fcn.100363c6
push 1
lea ecx, [ebp + 0x3c]
call fcn.100364db
push 2
lea ecx, [ebp + 0x3c]
call fcn.100364e7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp + 0x3c]
call fcn.100364f3
mov eax, 0x203e
cmp ax, di
je 0x1006e2da
mov eax, 0xd4ab
cmp ax, di
je 0x1006e2da
mov eax, 0x20fb
cmp ax, di
je 0x1006e2da
mov eax, 0x14e
cmp ax, di
je 0x1006e2da
push edi
call fcn.1006a79b
pop ecx
test al, al
jne 0x1006e2da
cmp byte [0x100d34e0], al
je 0x1006e2d5
mov eax, 0x1466
jmp 0x1006e2df
movzx eax, di
jmp 0x1006e2df
mov eax, 0x1bb
push eax
lea ecx, [ebp + 0x3c]
call fcn.100364ff
push dword [ebx + 4]
call fcn.1007c983
pop ecx
push dword [ebp + 0x70]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x54], eax
push eax
call fcn.10016500
push dword [ebx + 4]
mov byte [ebp - 4], 1
push dword [ebx]
push dword [ebp + 0x54]
call fcn.1007f300
add esp, 0xc
lea eax, [ebp + 0x54]
lea ecx, [ebp + 0x3c]
push dword [ebx + 4]
push eax
call fcn.10036486
sub esp, 0x10
lea eax, [ebp + 0x3c]
mov ecx, esp
mov dword [ebp + 0x50], esp
push eax
call fcn.1003bf8a
mov byte [ebp - 4], 2
call fcn.1005abea
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1007170e
cmp byte [0x100d34e0], 0
je 0x1006e403
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x3c]
call fcn.10035fd0
mov ecx, dword [ebp + 0x50]
mov eax, dword [eax]
mov dword [ebp + 0x20], eax
test ecx, ecx
je 0x1006e372
call fcn.1000a5c5
lea ecx, [ebp + 0x3c]
call fcn.10035fec
mov dword [ebp + 0x1c], eax
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100d3434], 0
je 0x1006e3ef
call fcn.1005abea
mov esi, dword [eax + 0x2c]
mov esi, dword [esi]
call fcn.1005abea
cmp esi, dword [eax + 0x2c]
je 0x1006e3ef
mov ecx, dword [esi + 8]
call fcn.10017580
mov edi, str.IM_Capture
xor edx, edx
movzx ecx, byte [eax + edx]
cmp cl, byte [edi + edx]
jne 0x1006e3e1
inc edx
cmp edx, 0xb
jne 0x1006e3b8
mov ecx, dword [esi + 8]
lea edx, [ebp + 0x50]
mov edi, dword [ebp + 0x70]
push 0
push edx
mov eax, dword [ecx]
lea edx, [ebp + 0x1c]
push 1
push edx
push edi
call dword [eax + 0x18]
jmp 0x1006e3f2
mov edi, dword [esi]
mov esi, edi
call fcn.1005abea
cmp edi, dword [eax + 0x2c]
jne 0x1006e3a9
mov edi, dword [ebp + 0x70]
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1006e406
mov edi, dword [ebp + 0x70]
push dword [ebx]
call fcn.1007c98c
and dword [ebx], 0
and dword [ebx + 4], 0
pop ecx
mov ecx, dword [ebp + 0x58]
test ecx, ecx
je 0x1006e421
call fcn.1000a5c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x3c]
call fcn.10015fd0
jmp 0x1006e445
mov esi, dword [ebp + 0x74]
push 2
push dword [ebp + 0x78]
push esi
call fcn.1007077c
mov edi, dword [ebp + 0x70]
jmp 0x1006e448
mov edi, dword [ebp + 0x70]
mov esi, dword [ebp + 0x74]
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x5c], eax
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100d3434], 0
je 0x1006e49b
call fcn.1005abea
mov esi, dword [eax + 0x2c]
jmp 0x1006e48f
mov ecx, dword [esi + 8]
lea edx, [ebp + 0x5c]
push 1
push edx
push edi
mov eax, dword [ecx]
call dword [eax + 0x14]
test al, al
je 0x1006e49b
mov esi, dword [esi]
call fcn.1005abea
cmp esi, dword [eax + 0x2c]
jne 0x1006e47c
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x70], esi
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100d3434], 0
je 0x1006e503
call fcn.1005abea
mov esi, dword [eax + 0x2c]
mov esi, dword [esi]
call fcn.1005abea
cmp esi, dword [eax + 0x2c]
je 0x1006e500
mov ecx, dword [esi + 8]
lea edx, [ebp + 0x24]
push 0
push edx
push 1
mov eax, dword [ecx]
lea edx, [ebp + 0x5c]
push edx
push edi
call dword [eax + 0x18]
test al, al
jne 0x1006e4db
mov esi, dword [ebp + 0x70]
call fcn.1005abea
add eax, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp + 0x74]
cmp dword [ebp + 0x60], edi
je 0x1006e52c
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x60], edi
mov dword [ebp + 0x5c], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x68
leave
ret 0x10