Function at 0x10004d90
Capabilities:
Convert ip address from string
Resolve function by parsing pe exports
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100996d4
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x100b5004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x144], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x148], eax
cmp dword [eax + 0x18], 0
jne 0x10004dfd
mov esi, 0x54f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret 8
call fcn.10005850
mov esi, eax
test esi, esi
jne 0x10004ddd
mov al, byte [ebx + 0x46]
mov esi, dword [ebp - 0x148]
mov cl, al
cmp al, 2
je 0x10004e3a
cmp al, 7
je 0x10004e3a
push 4
lea eax, [ebx + 0x4150]
push eax
push 0x700b
push 0xffff
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, byte [ebx + 0x46]
movsx eax, cl
dec eax
cmp eax, 7
ja case.0x10004e47.6
jmp dword [eax*4 + 0x1000582c]
push 0x60
call fcn.1007bcba
mov edi, eax
mov dword [ebp - 0x138], edi
push 0x60
push 0
push edi
mov dword [ebp - 4], 0
call fcn.1007d2d0
push 0x38
call fcn.1007bcba
push 0x38
mov esi, eax
push 0
push esi
mov dword [ebp - 0x13c], esi
call fcn.1007d2d0
mov eax, dword [ebp - 0x148]
add esp, 0x20
mov ecx, esi
push dword [eax + 0x18]
call fcn.100035c0
sub esp, 0x28
mov edx, eax
movzx eax, byte [ebp - 0x11c]
mov ecx, esp
push edx
mov dword [ecx], 0x100a9e18
mov dword [ecx + 4], 0x10005ee0
mov byte [ecx + 8], al
movzx eax, byte [ebp - 0x11b]
mov byte [ecx + 9], al
movzx eax, byte [ebp - 0x11a]
mov byte [ecx + 0xa], al
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x24], ecx
mov ecx, edi
call fcn.100037e0
mov edi, eax
jmp 0x100056a6
push 0x60
call fcn.1007bcba
mov ebx, eax
mov dword [ebp - 0x138], ebx
push 0x60
push 0
push ebx
mov dword [ebp - 4], 1
call fcn.1007d2d0
push 0x34
call fcn.1007bcba
push 0x34
mov edi, eax
push 0
push edi
mov dword [ebp - 0x13c], edi
call fcn.1007d2d0
mov ecx, dword [esi + 0x18]
add esp, 0x20
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi], vtable.CXVTcpSocketClient.0
mov dword [edi + 4], ecx
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
call esi
mov dword [edi + 0x30], eax
sub esp, 0x28
movzx eax, byte [ebp - 0x11c]
mov ecx, esp
push edi
mov dword [ecx], 0x100a9e18
mov dword [ecx + 4], 0x10005ee0
mov byte [ecx + 8], al
movzx eax, byte [ebp - 0x11b]
mov byte [ecx + 9], al
movzx eax, byte [ebp - 0x11a]
mov byte [ecx + 0xa], al
mov eax, dword [ebp - 0x144]
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x24], ecx
mov ecx, ebx
call fcn.10003dc0
mov ebx, dword [ebp - 0x144]
mov edi, eax
jmp 0x100056a6
push 0xd8
call fcn.1007bcba
mov edi, eax
mov dword [ebp - 0x138], edi
push 0xd8
push 0
push edi
mov dword [ebp - 4], 2
call fcn.1007d2d0
push 0x38
call fcn.1007bcba
push 0x38
mov esi, eax
push 0
push esi
mov dword [ebp - 0x13c], esi
call fcn.1007d2d0
mov eax, dword [ebp - 0x148]
add esp, 0x20
mov ecx, esi
push dword [eax + 0x18]
call fcn.100035c0
sub esp, 0x28
mov edx, eax
movzx eax, byte [ebp - 0x11c]
mov ecx, esp
push edx
mov dword [ecx], 0x100a9e18
mov dword [ecx + 4], 0x10005ee0
mov byte [ecx + 8], al
movzx eax, byte [ebp - 0x11b]
mov byte [ecx + 9], al
movzx eax, byte [ebp - 0x11a]
mov byte [ecx + 0xa], al
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x24], ecx
mov ecx, edi
call fcn.100039b0
mov edi, eax
jmp 0x100056a6
mov ecx, dword [ebx + 0x4168]
call fcn.10019780
push 0xc8
mov dword [ebp - 0x140], eax
call fcn.1007bcba
mov edi, eax
mov dword [ebp - 0x138], edi
push 0xc8
push 0
push edi
mov dword [ebp - 4], 3
call fcn.1007d2d0
push 0x40
call fcn.1007bcba
push 0x40
push 0
push eax
mov dword [ebp - 0x144], eax
call fcn.1007d2d0
add esp, 0x20
push dword [esi + 0x18]
mov esi, dword [ebp - 0x144]
mov ecx, esi
call fcn.100035c0
mov eax, dword [ebp - 0x140]
mov dword [esi + 0x38], eax
movzx eax, byte [ebp - 0x11c]
mov dword [esi], vtable.CXTlsSocketClient.0
mov dword [esi + 0x3c], 0
mov byte [ebp - 0x168], al
movzx eax, byte [ebp - 0x11b]
mov byte [ebp - 0x167], al
movzx eax, byte [ebp - 0x11a]
mov byte [ebp - 0x166], al
lea eax, [ebp - 0x170]
mov dword [ebp - 0x170], 0x100a9e18
mov dword [ebp - 0x16c], 0x10005ee0
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x14c], eax
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x13c], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x14c]
test edx, edx
je 0x1000515e
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + 0x24], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.100037e0
mov dword [edi], vtable.CXTlsServer.0
mov dword [edi + 0xc4], 0
mov ecx, dword [ebp - 0x144]
lea eax, [edi + 0x80]
mov byte [ebp - 4], 7
push eax
push 5
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x144]
mov ecx, 0x100dc668
mov dword [edi + 0x7c], eax
mov eax, dword [ebp - 0x140]
mov byte [edi + 0x84], 0
mov dword [edi + 0x88], eax
call fcn.1001f770
mov ecx, 0x100dc668
mov dword [edi + 0x8c], eax
call fcn.1001f770
mov edx, dword [edi + 0x8c]
mov ecx, dword [ebp - 0x140]
push eax
mov dword [edi + 0x90], eax
call fcn.1001e180
mov ecx, dword [ebp - 0x140]
call fcn.1001e300
push 0x10000
call fcn.1008dfec
push 0x10000
mov dword [edi + 0x94], eax
call fcn.1008dfec
add esp, 0xc
mov dword [edi + 0x98], eax
lea eax, [edi + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x170]
push eax
lea ecx, [edi + 0xa0]
call fcn.100063a0
push 8
call fcn.1007bcba
add esp, 4
mov dword [ebp - 0x13c], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 8
mov ecx, eax
movq qword [eax], xmm0
call fcn.10003420
mov dword [edi + 0x78], eax
mov ecx, dword [ebp - 0x14c]
test ecx, ecx
je 0x100056a6
mov edx, dword [ecx]
lea eax, [ebp - 0x170]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14c], 0
jmp 0x100056a6
mov ecx, dword [ebx + 0x4168]
call fcn.10019780
push 0x120
mov dword [ebp - 0x140], eax
call fcn.1007bcba
mov edi, eax
mov dword [ebp - 0x138], edi
push 0x120
push 0
push edi
mov dword [ebp - 4], 9
call fcn.1007d2d0
push 0x40
call fcn.1007bcba
push 0x40
push 0
push eax
mov dword [ebp - 0x144], eax
call fcn.1007d2d0
add esp, 0x20
push dword [esi + 0x18]
mov esi, dword [ebp - 0x144]
mov ecx, esi
call fcn.100035c0
mov eax, dword [ebp - 0x140]
mov dword [esi + 0x38], eax
movzx eax, byte [ebp - 0x11c]
mov dword [esi], vtable.CXTlsSocketClient.0
mov dword [esi + 0x3c], 0
mov byte [ebp - 0x190], al
movzx eax, byte [ebp - 0x11b]
mov byte [ebp - 0x18f], al
movzx eax, byte [ebp - 0x11a]
mov byte [ebp - 0x18e], al
lea eax, [ebp - 0x198]
mov dword [ebp - 0x198], 0x100a9e18
mov dword [ebp - 0x194], 0x10005ee0
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x174], eax
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x13c], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x174]
test edx, edx
je 0x10005374
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + 0x24], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.100039b0
mov dword [edi], vtable.CXHttpsServer.0
mov dword [edi + 0x11c], 0
mov ecx, dword [ebp - 0x144]
lea eax, [edi + 0xdc]
mov byte [ebp - 4], 0xd
push eax
push 5
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x144]
mov ecx, 0x100dc668
mov dword [edi + 0xd8], eax
mov eax, dword [ebp - 0x140]
mov byte [edi + 0xe0], 0
mov dword [edi + 0xe4], eax
call fcn.1001f770
mov ecx, 0x100dc668
mov dword [edi + 0xe8], eax
call fcn.1001f770
mov edx, dword [edi + 0xe8]
mov ecx, dword [ebp - 0x140]
push eax
mov dword [edi + 0xec], eax
call fcn.1001e180
mov ecx, dword [ebp - 0x140]
call fcn.1001e300
push 0x10000
call fcn.1008dfec
push 0x10000
mov dword [edi + 0xf0], eax
call fcn.1008dfec
add esp, 0xc
mov dword [edi + 0xf4], eax
lea eax, [ebp - 0x198]
lea ecx, [edi + 0xf8]
push eax
call fcn.100063a0
mov ecx, dword [ebp - 0x174]
test ecx, ecx
je 0x100056a6
mov edx, dword [ecx]
lea eax, [ebp - 0x198]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x174], 0
jmp 0x100056a6
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x140], edi
push eax
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameA]
push 0x1bd
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x122], ax
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x120], 0
mov eax, dword [edi]
push ecx
push 1
mov ecx, edi
call dword [eax + 0x18]
xor eax, eax
mov word [ebp - 0x132], ax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x114]
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
mov eax, dword [edi]
lea ecx, [ebp - 0x134]
push ecx
push 2
mov ecx, edi
call dword [eax + 0x18]
jmp 0x100056b9
push 0x88
call fcn.1007bcba
mov edi, eax
mov dword [ebp - 0x138], edi
push 0x88
push 0
push edi
mov dword [ebp - 4], 0xe
call fcn.1007d2d0
push 0x38
call fcn.1007bcba
push 0x38
push 0
push eax
mov dword [ebp - 0x13c], eax
call fcn.1007d2d0
add esp, 0x20
push dword [esi + 0x18]
mov esi, dword [ebp - 0x13c]
mov ecx, esi
call fcn.100035c0
movzx eax, byte [ebp - 0x11c]
mov dword [esi], vtable.CXWsSocketClient.0
mov byte [ebp - 0x1b8], al
movzx eax, byte [ebp - 0x11b]
mov byte [ebp - 0x1b7], al
movzx eax, byte [ebp - 0x11a]
mov byte [ebp - 0x1b6], al
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x100a9e18
mov dword [ebp - 0x1bc], 0x10005ee0
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x19c], eax
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x13c], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x19c]
test edx, edx
je 0x100055b8
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + 0x24], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.100037e0
lea eax, [edi + 0x68]
mov byte [ebp - 4], 0x11
push eax
mov dword [edi], vtable.CXWsServer.0
mov byte [edi + 0x60], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 8
call fcn.1007bcba
add esp, 4
mov dword [ebp - 0x13c], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 0x12
mov ecx, eax
movq qword [eax], xmm0
call fcn.10003420
mov byte [ebp - 4], 0x11
push 0x34
mov dword [edi + 0x64], eax
call fcn.1007bcba
mov esi, eax
mov dword [ebp - 0x13c], esi
push 0x34
push 0
push esi
call fcn.1007d2d0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
push 0x200050
mov byte [ebp - 4], 0x15
call fcn.1007bcba
mov dword [ebp - 0x138], eax
add esp, 0x14
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [esi], eax
mov dword [edi + 0x80], esi
mov ecx, dword [ebp - 0x19c]
test ecx, ecx
je 0x100056a6
mov edx, dword [ecx]
lea eax, [ebp - 0x1c0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x19c], 0
mov esi, dword [ebp - 0x148]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x140], edi
mov dl, byte [ebx + 0x46]
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dl, 2
jne 0x10005777
mov ecx, dword [ebx + 0x4154]
mov dword [ebp - 0x138], ecx
mov ecx, dword [esi + 0x18]
mov esi, dword [0x100df518]
push esi
mov dword [ebp - 0x13c], ecx
call eax
mov ecx, dword [ebp - 0x13c]
cmp ecx, dword [0x100df520]
jae 0x10005766
mov eax, dword [0x100df51c]
cmp dword [eax + ecx*8], 0
je 0x10005766
mov eax, dword [eax + ecx*8 + 4]
push esi
mov dword [ebp - 0x144], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x144]
mov eax, dword [esi + 0x458]
sub eax, 0x66
je 0x10005731
sub eax, 0x62
je 0x10005731
sub eax, 1
jne 0x10004dd8
add esi, 0x490
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x138]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [eax + 0x488], ecx
mov dword [eax + 0x48c], edi
call esi
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x100057aa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 6
jmp 0x10004ddd
cmp dl, 7
je 0x100057a4
push 0
push edi
push dword [ebx + 0x4154]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x1000579f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10004ddd
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebx + 0x417c]
push ecx
call eax
mov eax, dword [ebx + 0x4174]
lea ecx, [ebx + 0x4170]
cmp eax, dword [ecx + 8]
je 0x100057cc
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x100057d9
lea edx, [ebp - 0x140]
push edx
push eax
call fcn.10006510
lea eax, [ebx + 0x417c]
push eax
call esi
mov eax, dword [ebp - 0x148]
mov ecx, ebx
push dword [eax + 0x18]
call fcn.10005cf0
mov esi, eax
test esi, esi
jne 0x10004ddd
mov ecx, dword [ebx + 0x40fc]
mov dword [ebp - 0x138], edi
test ecx, ecx
je 0x10005824
mov eax, dword [ecx]
lea edx, [ebp - 0x138]
push edx
call dword [eax + 8]
jmp 0x10004ddd
xor eax, eax
jmp 0x10004ddf
call fcn.1008e60c
nop dword [eax]
dec esi
dec esi
add byte [eax], dl
loope 0x10005880
add byte [eax], dl
ror dword [edi], 1
adc byte [edx + 80], ch
add byte [eax], dl
adc byte [edx], 0x10
sbb eax, 1779433560
push esp
add byte [eax], dl
in eax, 0x54
add byte [eax], dl
int3
mov ch, 0xe0
invalid