decode this fully .text:004C6202 ; =============== S U B R O U T I N E ======================================= .text:004C6202 .text:004C6202 ; F_CREATE_STATIC_READER - Network Byte Order Conversion Function .text:004C6202 ; ════════════════════════════════════════════════════════════════ .text:004C6202 ; Purpose: Converts buffer data from network byte order to host byte order .text:004C6202 ; .text:004C6202 ; Processing Flow: .text:004C6202 ; 1. Converts first 4 bytes as network long (ntohl) .text:004C6202 ; 2. Converts subsequent 2-byte values as network shorts (ntohs) .text:004C6202 ; 3. Operates directly on buffer passed via ESI register .text:004C6202 ; .text:004C6202 ; Buffer Layout (0x24 bytes): .text:004C6202 ; 0x00 uint16 netshort1 - Network short (ntohs) .text:004C6202 ; 0x02 uint16 netshort2 - Network short (ntohs) .text:004C6202 ; 0x04 uint16 netshort3 - Network short (ntohs) .text:004C6202 ; 0x06 uint16 netshort4 - Network short (ntohs) .text:004C6202 ; 0x08 uint32 netlong1 - Network long (ntohl) .text:004C6202 ; 0x0C uint32 netlong2 - Network long (ntohl) .text:004C6202 ; 0x10 uint16 netshort5 - Network short (ntohs) .text:004C6202 ; 0x12 uint32 netlong3 - Network long (ntohl) .text:004C6202 ; 0x16 uint32 netlong4 - Network long (ntohl) .text:004C6202 ; .text:004C6202 ; Returns: None (modifies buffer in-place) .text:004C6202 .text:004C6202 ; u_long __usercall F_CREATE_STATIC_READER@(int@) .text:004C6202 F_CREATE_STATIC_READER proc near ; CODE XREF: PacketHandler+DCC↑p .text:004C6202 movzx eax, word ptr [esi] ; Access netshort1 at offset 0x00 .text:004C6205 push eax ; netshort .text:004C6206 call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C620B mov [esi], ax .text:004C620E movzx eax, word ptr [esi+2] ; Access netshort2 at offset 0x02 .text:004C6212 push eax ; netshort .text:004C6213 call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C6218 mov [esi+2], ax .text:004C621C movzx eax, word ptr [esi+4] ; Access netshort3 at offset 0x04 .text:004C6220 push eax ; netshort .text:004C6221 call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C6226 mov [esi+4], ax .text:004C622A movzx eax, word ptr [esi+6] ; Access netshort4 at offset 0x06 .text:004C622E push eax ; netshort .text:004C622F call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C6234 push dword ptr [esi+8] ; netlong .text:004C6237 mov [esi+6], ax .text:004C623B call ntohl ; Converts 4 bytes from network to host byte order (ntohl) .text:004C6240 push dword ptr [esi+0Ch] ; netlong .text:004C6243 mov [esi+8], eax .text:004C6246 call ntohl ; Converts 4 bytes from network to host byte order (ntohl) .text:004C624B mov [esi+0Ch], eax .text:004C624E movzx eax, word ptr [esi+10h] ; Access network buffer field .text:004C6252 push eax ; netshort .text:004C6253 call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C6258 push dword ptr [esi+14h] ; netlong .text:004C625B mov [esi+10h], ax .text:004C625F call ntohl ; Converts 4 bytes from network to host byte order (ntohl) .text:004C6264 mov [esi+14h], eax .text:004C6267 movzx eax, word ptr [esi+18h] ; Access network buffer field .text:004C626B push eax ; netshort .text:004C626C call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C6271 mov [esi+18h], ax .text:004C6275 movzx eax, word ptr [esi+1Ch] ; Access network buffer field .text:004C6279 push eax ; netshort .text:004C627A call ntohs ; Converts 2 bytes from network to host byte order (ntohs) .text:004C627F push dword ptr [esi+20h] ; netlong .text:004C6282 mov [esi+1Ch], ax .text:004C6286 call ntohl ; Converts 4 bytes from network to host byte order (ntohl) .text:004C628B push dword ptr [esi+24h] ; netlong .text:004C628E mov [esi+20h], eax .text:004C6291 call ntohl ; Converts 4 bytes from network to host byte order (ntohl) .text:004C6296 mov [esi+24h], eax .text:004C6299 retn .text:004C6299 F_CREATE_STATIC_READER endp .text:004C6299
?
you stuck?
This is a detailed disassembly of the function F_CREATE_STATIC_READER, which processes a 0x28-byte buffer (40 bytes) passed via the ESI register. The purpose of this function is to convert data in the buffer from network byte order to host byte order, performing in-place modifications (i.e., it overwrites the buffer directly). The byte order conversion functions used are:
ntohs (Network TO Host Short) — for 2-byte values (16 bits)
ntohl (Network TO Host Long) — for 4-byte values (32 bits)
Let’s break down exactly what it does, field by field, in pseudo-C code for better clarity.
🔧 Function Summary Function Prototype (Pseudo-C): void F_CREATE_STATIC_READER(uint8_t* buffer);
Purpose:
Converts fields from network byte order (big-endian) to host byte order (depends on machine, usually little-endian on x86).
Buffer structure is assumed fixed.
🧠 Buffer Layout Before Processing Offset Size Name Type Notes 0x00 2 netshort1 uint16 Converted using ntohs 0x02 2 netshort2 uint16 Converted using ntohs 0x04 2 netshort3 uint16 Converted using ntohs 0x06 2 netshort4 uint16 Converted using ntohs 0x08 4 netlong1 uint32 Converted using ntohl 0x0C 4 netlong2 uint32 Converted using ntohl 0x10 2 netshort5 uint16 Converted using ntohs 0x12 2 ? (padding?) uint16 Not converted! (likely padding) 0x14 4 netlong3 uint32 Converted using ntohl 0x18 2 netshort6 uint16 Converted using ntohs 0x1A 2 ? (padding?) uint16 Not converted! (likely padding) 0x1C 2 netshort7 uint16 Converted using ntohs 0x1E 2 ? (padding?) uint16 Not converted! (likely padding) 0x20 4 netlong4 uint32 Converted using ntohl 0x24 4 netlong5 uint32 Converted using ntohl
Total size = 0x28 bytes = 40 bytes
🧾 Decompilation (Clean C Pseudo-Code) void F_CREATE_STATIC_READER(uint8_t* buffer) { uint16_t* s = (uint16_t*)buffer; uint32_t* l = (uint32_t*)buffer;
// Shorts: offsets 0x00, 0x02, 0x04, 0x06
s[0] = ntohs(s[0]); // netshort1
s[1] = ntohs(s[1]); // netshort2
s[2] = ntohs(s[2]); // netshort3
s[3] = ntohs(s[3]); // netshort4
// Longs: offsets 0x08, 0x0C
l[2] = ntohl(l[2]); // netlong1 (offset 0x08)
l[3] = ntohl(l[3]); // netlong2 (offset 0x0C)
// Short: offset 0x10
s[8] = ntohs(s[8]); // netshort5
// Long: offset 0x14
l[5] = ntohl(l[5]); // netlong3
// Short: offset 0x18
s[12] = ntohs(s[12]); // netshort6
// Short: offset 0x1C
s[14] = ntohs(s[14]); // netshort7
// Longs: offset 0x20, 0x24
l[8] = ntohl(l[8]); // netlong4
l[9] = ntohl(l[9]); // netlong5
}
🧩 Observations and Clarifications
The disassembly skips over certain 2-byte regions (e.g., at offsets 0x12, 0x1A, 0x1E) — this suggests they may be padding, reserved, or unused fields.
All modifications are in-place — the function does not return any value.
This pattern is typical in network protocol parsers, where binary packets received over the wire (in big-endian/network order) need to be translated to host-native representations.*