joyce8/EMBER2024-capa huggingface dataset:
Function at 0x646470
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x6d63d0]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [eax]
push esi
call fcn.0063cb70
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x6464b3
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.00671b23
add esp, 0x20
ret
lea eax, [ebx + 0x64]
cmp ebx, eax
push ebp
push edi
mov dword [esp + 0x14], eax
jge 0x646572
mov ebp, dword [esp + 0x38]
jmp 0x6464d0
push ebx
mov word [esp + 0x20], 2
call sub.WSOCK32.dll_htons
test ebp, ebp
mov word [esp + 0x1e], ax
jne 0x6464ec
mov dword [esp + 0x20], ebp
jmp 0x646526
push ebp
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x646526
mov edi, str.255.255.255.255
mov esi, ebp
mov ecx, 0x10
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x646522
push ebp
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x646522
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
mov esi, dword [esp + 0x10]
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x20], eax
jne 0x64653e
mov dword [esp + 0x20], 0
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call sub.WSOCK32.dll_bind
test eax, eax
je 0x646572
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jl 0x6464d0
pop edi
pop ebp
pop esi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.00671b23
add esp, 0x20
ret
test ebx, ebx
jne 0x64659f
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x24], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x64655c
mov eax, dword [esp + 0x1e]
push eax
call sub.WSOCK32.dll_ntohs
movzx ebx, ax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0x28]
pop ebp
pop esi
mov dword [edx], ebx
xor eax, eax
pop ebx
call fcn.00671b23
add esp, 0x20
ret

Function at 0x646650
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x6d63d0]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc4]
test eax, eax
mov dword [esp], 0x10
je 0x6466cc
mov eax, dword [esi]
push eax
call fcn.0063cc00
add esp, 4
test eax, eax
je 0x6466cc
lea esp, [esp]
mov eax, dword [esi]
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0xff
push 0x76ee98
push eax
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x6466bd
lea ecx, [esp + 4]
push ecx
push eax
push 0x76ee98
push esi
mov byte [eax + 0x76ee98], 0
call fcn.00645ed0
add esp, 0x10
mov edx, dword [esi]
push edx
call fcn.0063cc00
add esp, 4
test eax, eax
jne 0x646680
mov ecx, dword [esp + 0x14]
call fcn.00671b23
add esp, 0x18
ret
Function at 0x649890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
test esi, esi
jle 0x64994b
push ebx
movzx ecx, cl
movzx esi, dl
push ebp
lea esp, [esp]
lea edx, [ecx + 1]
and edx, 0x800000ff
jns 0x6498d3
dec edx
or edx, 0xffffff00
inc edx
movzx ecx, dl
mov bl, byte [ecx + eax]
mov byte [esp + 0x20], bl
movzx ebx, bl
add ebx, esi
and ebx, 0x800000ff
jns 0x6498f2
dec ebx
or ebx, 0xffffff00
inc ebx
movzx esi, bl
mov byte [esp + 0x13], bl
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov bl, byte [esp + 0x20]
mov byte [esi + eax], bl
movzx ebp, byte [ecx + eax]
movzx ebx, bl
add ebx, ebp
and ebx, 0x800000ff
jns 0x64991f
dec ebx
or ebx, 0xffffff00
inc ebx
mov ebp, dword [esp + 0x18]
movzx ebx, bl
mov bl, byte [ebx + eax]
xor byte [edi + ebp], bl
mov ebx, dword [esp + 0x1c]
inc edi
cmp edi, ebx
jl 0x6498c0
mov cl, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x64f260
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x118]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp eax, ebx
jle 0x64f322
push edi
mov edi, dword [esi]
lea eax, [esp + 8]
push eax
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x40
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call sub.WSOCK32.dll_select
cmp eax, ebx
jle 0x64f321
lea edx, [esp + 0x10]
push edx
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x64f321
mov eax, dword [esi + 0x118]
cmp eax, 0x400
jl 0x64f2c6
mov eax, 0x400
mov ecx, dword [esi]
push ebx
push eax
mov eax, dword [esi + 0x114]
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, ebx
je 0x64f321
cmp eax, 0xffffffff
je 0x64f321
mov ecx, dword [esi + 0x118]
sub ecx, eax
mov edx, ecx
mov dword [esi + 0x118], ecx
mov ecx, dword [esi + 0x114]
push edx
lea edx, [ecx + eax]
push edx
push ecx
call fcn.00672210
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 0x118]
mov byte [eax + ecx], bl
mov eax, dword [esi + 0x118]
add esp, 0xc
cmp eax, ebx
jg 0x64f278
pop edi
pop ebx
add esp, 0x10c
ret
Function at 0x64f330
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push edi
xor ebx, ebx
jmp 0x64f340
mov edi, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x40
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call sub.WSOCK32.dll_select
cmp eax, ebx
jle 0x64f439
lea edx, [esp + 0x14]
push edx
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x64f439
mov edi, dword [esi + 0x10c]
mov eax, dword [esi + 0x110]
add edi, 0x1000
cmp edi, eax
jle 0x64f3d5
add edi, 0x2000
mov eax, edi
and eax, 0x80001fff
jns 0x64f3b0
dec eax
or eax, 0xffffe000
inc eax
mov edx, dword [esi + 0x108]
sub edi, eax
lea ecx, [edi + 1]
push ecx
push edx
call fcn.006746d7
add esp, 8
cmp eax, ebx
je 0x64f439
mov dword [esi + 0x108], eax
mov dword [esi + 0x110], edi
mov edi, dword [esi + 0x10c]
mov ecx, dword [esi + 0x108]
mov eax, dword [esi]
push ebx
push 0x1000
add edi, ecx
push edi
push eax
call sub.WSOCK32.dll_recv
mov ebp, eax
cmp ebp, ebx
jle 0x64f42d
cmp dword [esi + 0x120], ebx
je 0x64f411
lea ecx, [esi + 0x124]
push ecx
push ebp
push edi
call fcn.00649890
add esp, 0xc
mov eax, dword [esi + 0x10c]
mov edx, dword [esi + 0x108]
add eax, ebp
mov dword [esi + 0x10c], eax
mov byte [eax + edx], bl
jmp 0x64f340
call sub.WSOCK32.dll_WSAGetLastError
mov dword [esi + 4], 2
pop edi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x64ff10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x24
mov eax, dword [0x6d63d0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
test eax, eax
mov byte [esp], 0x91
mov byte [esp + 1], 1
mov byte [esp + 2], bh
mov byte [esp + 3], bl
mov byte [esp + 4], dh
mov byte [esp + 5], dl
mov byte [esp + 6], ch
mov byte [esp + 7], cl
je 0x64ff70
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x64ff8a
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [0x6d1e94]
push 0x10
push ecx
push 0
push 0x20
lea edx, [esp + 0x10]
push edx
push eax
call sub.WSOCK32.dll_sendto
mov ecx, dword [esp + 0x20]
sub eax, 0x20
neg eax
sbb eax, eax
inc eax
call fcn.00671b23
add esp, 0x24
ret
Function at 0x64ffc0
Capabilities:
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x6d63d0]
mov dword [esp + 0x14], eax
call fcn.0063cb70
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push ecx
mov dword [esp + 0x14], eax
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
test esi, esi
mov word [esp + 6], ax
je 0x65001f
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x650019
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x650074
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
mov dword [esp + 8], eax
jmp 0x650027
mov dword [esp + 8], 0
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x6d1e94], eax
je 0x65006f
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_setsockopt
mov eax, dword [0x6d1e94]
push 0x10
lea edx, [esp + 8]
push edx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x650083
call sub.WSOCK32.dll_WSAGetLastError
xor eax, eax
mov ecx, dword [esp + 0x14]
call fcn.00671b23
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov eax, 1
call fcn.00671b23
add esp, 0x18
ret

Function at 0x650640
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x6d63d0]
push ebx
mov dword [esp + 0x5c], eax
mov eax, dword [0x7700d0]
test eax, eax
push esi
push edi
je 0x65073d
mov eax, dword [0x6d1e94]
push eax
call fcn.0063cc00
add esp, 4
test eax, eax
je 0x65073d
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x6d1e94]
lea edx, [esp + 0x20]
push edx
push 0
push 0x20
lea eax, [esp + 0x54]
push eax
push ecx
mov dword [esp + 0x30], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x6506b6
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2738
jne 0x650747
jmp 0x6506bf
cmp eax, 0x20
jl 0x650747
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
lea esi, [esp + 0x2c]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x44]
call fcn.0064fe80
test eax, eax
je 0x650730
mov ax, word [esp + 0x12]
cmp ax, 1
jne 0x6506f5
lea esi, [esp + 0x1c]
lea ecx, [esp + 0x10]
call fcn.006503a0
jmp 0x650730
cmp ax, 2
jne 0x650713
push edi
lea edx, [esp + 0x30]
push edx
lea edi, [esp + 0x24]
lea ecx, [esp + 0x18]
call fcn.006504d0
add esp, 8
jmp 0x650730
cmp ax, 3
jne 0x650730
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
lea ebx, [esp + 0x20]
lea eax, [esp + 0x14]
call fcn.006505d0
add esp, 4
mov eax, dword [0x7700d0]
test eax, eax
jne 0x650662
call sub.KERNEL32.dll_GetTickCount
mov dword [0x7700c8], eax
mov ecx, dword [esp + 0x64]
call fcn.00671b23
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x650cc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x6d63d0]
mov dword [esp + 0x114], eax
mov eax, dword [ebx + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
je 0x650ce7
mov dword [eax + 0x20], esi
mov dword [ebx + 0xc], esi
mov dword [esi + 0x20], 0
mov eax, dword [ebx + 8]
test eax, eax
jne 0x650cfb
mov dword [ebx + 8], esi
inc dword [ebx + 0x10]
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x1c], eax
cmp dword [ebx], 1
jne 0x650d71
mov dword [esp + 0x1b], eax
test byte [esi + 0x14], 4
mov byte [esp + 0x18], 0xfe
mov byte [esp + 0x19], 0xfd
mov byte [esp + 0x1a], 0
je 0x650d5c
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
mov al, byte [ebx + 0x3c]
mov byte [esp + 0x1f], al
jle 0x650d4a
mov edx, ecx
shr ecx, 2
lea esi, [ebx + 0x28]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov byte [esp + eax + 0x20], 0
mov byte [esp + eax + 0x21], 0
lea ecx, [eax + 0xa]
jmp 0x650dbd
mov al, 0xff
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov ecx, 0xa
jmp 0x650dbd
test byte [esi + 0x14], 4
je 0x650da4
mov eax, dword [str._basicinfo_]
mov ecx, dword [0x6a25dc]
mov edx, dword [0x6a25e0]
mov dword [esp + 0x18], eax
mov al, byte [0x6a25e4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x24], al
mov ecx, 0xd
jmp 0x650dbd
mov ecx, dword [str._status_]
mov edx, dword [0x6a25d0]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ecx, 8
mov eax, dword [esi]
cmp eax, dword [ebx + 0x24]
mov edx, 2
mov word [esp + 8], dx
jne 0x650de5
test byte [esi + 0x15], dl
je 0x650de5
mov eax, dword [esi + 8]
mov dx, word [esi + 0xc]
mov dword [esp + 0xc], eax
mov word [esp + 0xa], dx
jmp 0x650df2
mov dword [esp + 0xc], eax
mov ax, word [esi + 4]
mov word [esp + 0xa], ax
push 0x10
lea edx, [esp + 0xc]
push edx
push 0
push ecx
mov ecx, dword [ebx + 0x20]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.WSOCK32.dll_sendto
mov ecx, dword [esp + 0x11c]
call fcn.00671b23
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6510f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x84c
mov eax, dword [0x6d63d0]
mov dword [esp + 0x848], eax
mov eax, dword [esi + 0x20]
push eax
mov dword [esp + 4], 0x10
call fcn.0063cc00
add esp, 4
test eax, eax
je 0x6511c5
push ebx
push edi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x10]
push edx
push 0
push 0x833
lea eax, [esp + 0x2c]
push eax
push ecx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x6511c3
mov edi, dword [esi + 8]
test edi, edi
mov byte [esp + eax + 0x1c], 0
je 0x6511af
mov bx, word [esp + 0xe]
mov edx, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [edi]
cmp ecx, edx
jne 0x65116c
cmp word [edi + 4], bx
je 0x65118b
cmp ecx, dword [esi + 0x24]
jne 0x651182
test byte [edi + 0x15], 2
je 0x651182
cmp dword [edi + 8], edx
jne 0x651182
cmp word [edi + 0xc], bx
je 0x65118b
mov edi, dword [edi + 0x20]
test edi, edi
jne 0x651160
jmp 0x6511af
cmp dword [esi], 1
jne 0x6511a2
push eax
push esi
lea eax, [esp + 0x24]
mov ebx, edi
call fcn.00650f60
add esp, 8
jmp 0x6511af
push esi
lea ebx, [esp + 0x20]
call fcn.00651080
add esp, 4
mov edx, dword [esi + 0x20]
push edx
call fcn.0063cc00
add esp, 4
test eax, eax
jne 0x651120
pop edi
pop ebx
mov ecx, dword [esp + 0x848]
call fcn.00671b23
add esp, 0x84c
ret

Function at 0x651bf0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x94
mov eax, dword [0x6d63d0]
push esi
mov dword [esp + 0x94], eax
lea esi, [edi + 0xc]
push 0x14
mov eax, esi
call fcn.00651bb0
mov ecx, eax
mov eax, dword [0x7700e0]
add esp, 4
test eax, eax
je 0x651c2f
lea edx, [esp + 0x14]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x651c23
jmp 0x651c43
push ecx
push esi
lea eax, [esp + 0x1c]
push str._s.ms_d.gamespy.com
push eax
call fcn.00671a9a
add esp, 0x10
push 0x70ee
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_inet_addr
or esi, 0xffffffff
cmp eax, esi
mov dword [esp + 8], eax
jne 0x651ca0
lea edx, [esp + 0x14]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x651c95
mov eax, 2
pop esi
mov ecx, dword [esp + 0x90]
call fcn.00671b23
add esp, 0x94
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
cmp dword [edi + 0x4a0], esi
jne 0x651cd6
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, esi
mov dword [edi + 0x4a0], eax
jne 0x651cd6
mov eax, 1
pop esi
mov ecx, dword [esp + 0x90]
call fcn.00671b23
add esp, 0x94
ret
mov ecx, dword [edi + 0x4a0]
push 0x10
lea eax, [esp + 8]
push eax
push ecx
call sub.WSOCK32.dll_connect
test eax, eax
je 0x651d18
mov edx, dword [edi + 0x4a0]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [edi + 0x4a0], esi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x90]
call fcn.00671b23
add esp, 0x94
ret
mov ecx, dword [esp + 0x94]
xor eax, eax
pop esi
call fcn.00671b23
add esp, 0x94
ret
Function at 0x653010
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x5f8
mov eax, dword [0x6d63d0]
mov dword [esp + 0x5f4], eax
mov eax, dword [esi + 0x4a0]
push edi
push eax
mov dword [esp + 0xc], 0x10
call fcn.0063cc00
add esp, 4
test eax, eax
je 0x6530ed
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x4a0]
lea edx, [esp + 0x10]
push edx
push 0
push 0x5db
lea eax, [esp + 0x2c]
push eax
push ecx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x6530d6
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
call fcn.00652490
add esp, 0xc
cmp eax, 0xffffffff
jne 0x6530d6
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0x10]
push ecx
push edx
push esi
call fcn.006519e0
mov edi, eax
push edi
call fcn.00651ab0
add esp, 0x10
test eax, eax
jne 0x65314b
push 0x11
push edi
call fcn.00651a50
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], edi
call fcn.0063bcd0
mov edx, dword [esi + 0x484]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push esi
call dword [esi + 0x480]
add esp, 0x20
mov ecx, dword [esi + 0x4a0]
push ecx
call fcn.0063cc00
add esp, 4
test eax, eax
jne 0x653042
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esi + 0x4a4]
cmp eax, 0x7d0
jbe 0x653135
mov edx, dword [esi + 0x4a0]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, dword [esi + 0x484]
push eax
mov dword [esi + 0x4a0], 0xffffffff
mov dword [esi], 1
mov ecx, dword [0x7700d8]
push ecx
push 3
push esi
call dword [esi + 0x480]
add esp, 0x10
xor eax, eax
pop edi
mov ecx, dword [esp + 0x5f4]
call fcn.00671b23
add esp, 0x5f8
ret
mov ecx, dword [esp + 0x5f8]
mov eax, 5
pop edi
call fcn.00671b23
add esp, 0x5f8
ret
Function at 0x653210
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30c
mov eax, dword [0x6d63d0]
mov dword [esp + 0x308], eax
mov eax, dword [esp + 0x314]
test eax, eax
jne 0x653238
mov dword [esp + 0x314], 0x68e414
push ebp
mov ebp, dword [esp + 0x31c]
test ebp, ebp
jne 0x653249
mov ebp, 0x68e414
mov eax, dword [esp + 0x318]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x653253
sub eax, edx
cmp eax, 0x100
ja 0x653278
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x653268
sub eax, edx
cmp eax, 0x100
jbe 0x653291
mov eax, 6
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.00671b23
add esp, 0x30c
ret
push edi
mov edi, dword [esp + 0x318]
call fcn.00651bf0
test eax, eax
jne 0x653414
push ebx
push esi
mov esi, dword [esp + 0x32c]
push edi
mov dword [edi + 0x5b4], esi
call fcn.00651d70
mov eax, dword [edi + 0x4a8]
mov dword [esp + 0x21], eax
lea ecx, [esp + 0x25]
add esp, 4
lea eax, [edi + 0xc]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x14]
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 3
mov dword [esp + 0x10], 9
mov dword [esp + 0x14], ecx
call fcn.00651d30
lea eax, [edi + 0x2c]
call fcn.00651d30
mov eax, dword [esp + 0x14]
lea edx, [edi + 0x6c]
mov ebx, dword [edx]
mov ecx, eax
mov dword [ecx], ebx
mov edx, dword [edx + 4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
add eax, 8
add edx, 8
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x10]
mov eax, ebp
lea edx, [esp + 0x14]
call fcn.00651d30
mov eax, dword [esp + 0x324]
call fcn.00651d30
push esi
call sub.WSOCK32.dll_htonl
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [ecx], eax
mov al, byte [edi + 0x5b4]
add esi, 4
add ecx, 4
test al, 8
je 0x65336d
mov eax, dword [edi + 0x494]
mov dword [ecx], eax
add esi, 4
add ecx, 4
mov al, byte [edi + 0x5b4]
test al, al
jns 0x653383
mov edx, dword [esp + 0x330]
mov dword [ecx], edx
add esi, 4
push esi
call sub.WSOCK32.dll_htons
mov ecx, dword [edi + 0x4a0]
xor ebx, ebx
push ebx
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x20]
push eax
push ecx
call sub.WSOCK32.dll_send
test eax, eax
jg 0x6533cc
push edi
call fcn.00652960
add esp, 4
pop esi
pop ebx
pop edi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.00671b23
add esp, 0x30c
ret
cmp dword [edi + 0x74], ebx
mov dword [edi], 3
mov dword [edi + 0x5b8], ebx
jne 0x653410
push 0x1000
call fcn.0067492b
add esp, 4
cmp eax, ebx
mov dword [edi + 0x74], eax
jne 0x65340d
pop esi
pop ebx
pop edi
mov eax, 5
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.00671b23
add esp, 0x30c
ret
mov dword [edi + 0x78], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x310]
pop edi
pop ebp
call fcn.00671b23
add esp, 0x30c
ret
Function at 0x653600
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x78]
xor ebx, ebx
cmp eax, 3
push edi
jl 0x653533
mov eax, dword [esi + 0x74]
movzx eax, word [eax]
push eax
call sub.WSOCK32.dll_ntohs
cmp ax, 0x1000
ja 0x653529
movzx edi, ax
cmp dword [esi + 0x78], edi
jl 0x653539
mov eax, dword [esi + 0x74]
movsx ecx, byte [eax + 2]
dec ecx
cmp ecx, 3
ja case.default.0x653476
jmp dword [ecx*4 + 0x653540]
lea ecx, [edi - 3]
push ecx
add eax, 3
mov ecx, esi
call fcn.00652e70
add esp, 4
mov ebx, eax
jmp case.default.0x653476
lea edx, [edi - 3]
push edx
add eax, 3
push eax
call fcn.00652f40
add esp, 8
mov ebx, eax
jmp case.default.0x653476
push 0
push edi
push eax
mov eax, dword [esi + 0x4a0]
push eax
call sub.WSOCK32.dll_send
test eax, eax
jg case.default.0x653476
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea ecx, [edi - 3]
cmp ecx, 6
jge 0x6534d2
mov ebx, 4
jmp case.default.0x653476
mov ecx, dword [eax + 3]
movzx eax, word [eax + 7]
push eax
push ecx
push esi
call fcn.00652490
add esp, 0xc
cmp eax, 0xffffffff
je 0x6534f3
push eax
push esi
call fcn.00652500
add esp, 8
xor ebx, ebx
mov eax, dword [esi + 0x78]
sub eax, edi
mov dword [esi + 0x78], eax
mov ecx, eax
je 0x653515
mov eax, dword [esi + 0x74]
test eax, eax
je 0x653515
push ecx
add edi, eax
push edi
push eax
call fcn.00672210
add esp, 0xc
test ebx, ebx
jne 0x65352e
cmp dword [esi + 0x78], 3
jge 0x653443
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov ebx, 4
call fcn.00653170
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
push esi
mov esi, eax
mov eax, dword [esi + 0x4a0]
push eax
call fcn.0063cc00
add esp, 4
test eax, eax
jne 0x653568
pop esi
ret
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x4a0]
push edi
mov edi, dword [esi + 0x78]
push 0
mov ecx, 0x1000
sub ecx, edi
push ecx
add edx, edi
push edx
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x6535ec
test eax, eax
je 0x6535ec
mov edx, dword [esi + 0x78]
mov ecx, dword [esi]
add edx, eax
cmp ecx, 2
mov dword [esi + 0x78], edx
mov eax, edx
je 0x6535ac
mov ecx, dword [esi + 0x5b8]
test ecx, ecx
jle 0x6535c4
mov ecx, dword [esi + 0x74]
sub eax, edi
push eax
add ecx, edi
push ecx
lea edx, [esi + 0x4ac]
push edx
call fcn.00650c30
add esp, 0xc
cmp dword [esi], 3
jne 0x6535d2
call fcn.00652b00
test eax, eax
jne 0x6535f6
cmp dword [esi], 2
jne 0x6535e7
mov eax, dword [esi + 0x78]
test eax, eax
jle 0x6535e7
pop edi
mov eax, esi
pop esi
jmp 0x653430
pop edi
xor eax, eax
pop esi
ret
call fcn.00653170
mov eax, 3
pop edi
pop esi
ret
push esi
mov esi, dword [esp + 8]
push esi
call fcn.006525a0
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x65362a
cmp eax, 1
jle 0x653626
cmp eax, 3
jg 0x653626
mov eax, esi
pop esi
jmp 0x653550
xor eax, eax
pop esi
ret
call fcn.00653010
pop esi
ret