Function at 0x4a47a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, edx
sub esp, 0x7c
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x300
je 0x4a4900
sub eax, 0x301
cmp eax, 1
ja 0x4a498c
mov ecx, 0x6568
mov esi, 0x6568
mov dword [ebp - 0x58], 0x65696c63
mov word [ebp - 0x4c], cx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x54], 0x6620746e
mov dword [ebp - 0x50], 0x73696e69
mov byte [ebp - 0x4a], 0x64
mov dword [ebp - 0x48], 0x76726573
mov dword [ebp - 0x44], 0x66207265
mov dword [ebp - 0x40], 0x73696e69
mov word [ebp - 0x3c], si
mov byte [ebp - 0x3a], 0x64
call fcn.004a3da0
mov dword [esp], 0
lea ecx, [ebp - 0x38]
call fcn.00588590
mov edx, dword [ebp + 8]
sub esp, 4
lea eax, [ebp - 0x58]
test edx, edx
jne 0x4a48f3
lea esi, [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x24]
mov edx, esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
call fcn.0045cda0
mov dword [esp], edi
mov ecx, esi
call fcn.004a4080
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.005993d0
mov ecx, esi
call fcn.00587bc0
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov dword [esp], 0xc
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
call fcn.00588590
lea ebx, [esi + 1]
mov eax, dword [ebp - 0x70]
sub esp, 4
mov ecx, dword [ebp - 0x74]
shr ebx, 1
mov dword [esp + 8], edi
mov edx, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
sub esi, ebx
mov dword [esp], ebx
add esi, ecx
call fcn.0048bab0
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], edi
mov ecx, esi
mov dword [esp], ebx
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x5c]
call fcn.0048bab0
lea ecx, [ebp - 0x38]
call fcn.00587bc0
lea ecx, [ebp - 0x64]
call fcn.0040d520
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x48]
jmp 0x4a4838
mov dword [esp], 0
lea esi, [ebp - 0x28]
mov ecx, esi
mov dword [ebp - 0x64], 0x544e4c43
mov dword [ebp - 0x58], 0x52565253
call fcn.00588590
mov eax, dword [ebp + 8]
sub esp, 4
test eax, eax
je 0x4a4970
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x48]
mov eax, edi
call fcn.0045cda0
mov dword [esp + 4], ebx
mov ecx, dword [ebp - 0x6c]
mov dword [esp], edi
call fcn.004a4220
sub esp, 8
mov ecx, esi
call fcn.00587bc0
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.0045cda0
jmp 0x4a4943
mov dword [esp], 8
call fcn.00641590
mov dword [esp], str.Finished_message:_Unknown_protocol_version
mov ecx, eax
mov ebx, eax
call fcn.00609320
push eax
mov dword [esp + 8], fcn.006093d0
mov dword [esp + 4], 0x6ff1c8
mov dword [esp], ebx
call fcn.00641c80
mov ebx, eax
jmp 0x64ff74
mov ecx, esi
call fcn.00587bc0
mov dword [esp], ebx
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
mov dword [esp], ebx
call fcn.00641890
mov dword [esp], esi
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
mov ecx, esi
call fcn.00587bc0
lea ecx, [ebp - 0x38]
call fcn.00587bc0
lea ecx, [ebp - 0x64]
call fcn.0040d520
mov dword [esp], ebx
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
mov ecx, dword [ebp - 0x6c]
call fcn.00587bc0
jmp 0x64ff9a