Function at 0x20f8c90
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
push 0x2c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
push ebx
xor edi, edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x4c], ebx
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp dword [esi + 4], ebx
je 0x20f8f31
cmp ecx, ebx
jne 0x20f8ce2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x40]
cmp eax, ebx
jbe 0x20f8d36
mov edi, eax
cmp eax, ecx
jb 0x20f8cf1
mov edi, ecx
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp + 0xc]
push edi
push eax
push ecx
call fcn.020f2440
sub dword [esi + 0x40], edi
mov eax, dword [esi + 0x40]
jne 0x20f8d1f
mov edx, dword [esi + 0x3c]
push edx
call fcn.020f24a0
add esp, 4
mov eax, edi
pop edi
mov dword [esi + 0x3c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x3c]
push eax
lea eax, [esi + edi]
push eax
push esi
call fcn.020f2440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
push ecx
push edx
call fcn.020f24e0
add esp, 8
cmp dword [ebp - 0x10], 0x80090318
je 0x20f8d5b
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x20f8f46
mov eax, dword [esi + 0x30]
cmp eax, ebx
jbe 0x20f8dac
cmp dword [esi + 0x2c], ebx
jne 0x20f8d6c
mov dword [esi + 0x30], ebx
jmp 0x20f8d46
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x38]
jbe 0x20f8d8a
mov ecx, dword [esi + 0x34]
push eax
push ecx
call fcn.020f2490
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
add esp, 8
mov dword [esi + 0x38], eax
mov edx, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x34]
push edx
push eax
call fcn.020f2440
mov ecx, dword [esi + 0x2c]
push ecx
call fcn.020f24a0
add esp, 4
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
jmp 0x20f8ddb
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
sub edx, edi
push edx
add eax, edi
push eax
push esi
call fcn.020f2bc0
mov edi, eax
add esp, 0xc
cmp edi, ebx
jg 0x20f8dd5
call sub.WS2_32.dll_WSAGetLastError
cmp dword [ebp - 8], ebx
je 0x20f8f46
add dword [ebp - 4], edi
mov edi, dword [ebp - 8]
add edi, dword [ebp - 4]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x40]
mov ecx, 3
lea esp, [esp]
mov dword [eax + 8], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
add eax, 0xc
sub ecx, 1
jne 0x20f8e00
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 8]
lea edx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], edx
call sub.Secur32.dll_DecryptMessage
mov dword [ebp - 0x10], eax
cmp eax, 0x80090318
je 0x20f8d46
cmp eax, ebx
jne 0x20f8f12
xor edi, edi
lea eax, [ebp - 0x40]
lea ecx, [edi + 3]
lea ecx, [ecx]
test edi, edi
jne 0x20f8e62
cmp dword [eax + 4], 1
jne 0x20f8e62
cmp dword [eax], edi
jbe 0x20f8e62
mov edi, eax
jmp 0x20f8e72
test ebx, ebx
jne 0x20f8e72
cmp dword [eax + 4], 5
jne 0x20f8e72
cmp dword [eax], ebx
jbe 0x20f8e72
mov ebx, eax
add eax, 0xc
sub ecx, 1
jne 0x20f8e50
test edi, edi
je 0x20f8ed2
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jbe 0x20f8ebe
mov edx, dword [esi + 0x3c]
sub eax, ecx
mov dword [esi + 0x40], eax
inc eax
push eax
push edx
mov dword [ebp - 4], ecx
call fcn.020f2490
add esp, 8
mov dword [esi + 0x3c], eax
test eax, eax
je 0x20f8f46
mov edx, dword [edi + 8]
mov ecx, dword [esi + 0x40]
add edx, dword [ebp + 0x10]
push ecx
push edx
push eax
call fcn.020f2440
mov eax, dword [ebp - 4]
jmp 0x20f8ec1
mov dword [ebp - 4], eax
add dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 8]
push eax
push ecx
call fcn.020f2440
test ebx, ebx
je 0x20f8f46
mov edx, dword [ebx]
mov eax, dword [esi + 0x2c]
inc edx
push edx
push eax
call fcn.020f2490
add esp, 8
mov dword [esi + 0x2c], eax
test eax, eax
je 0x20f8f46
mov ecx, dword [ebx]
mov edx, dword [esi + 0x34]
sub edx, ecx
add edx, dword [ebp - 8]
push ecx
push edx
push eax
call fcn.020f2440
mov eax, dword [ebx]
mov dword [esi + 0x30], eax
test edi, edi
jne 0x20f8f46
mov edi, dword [ebp - 8]
xor ebx, ebx
jmp 0x20f8d46
cmp eax, 0x90321
jne 0x20f8f46
push ebx
push ebx
push esi
call fcn.020f8790
add esp, 0xc
cmp eax, 1
jne 0x20f8f46
cmp dword [ebp - 0xc], ebx
jne 0x20f8f46
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call fcn.020f2bc0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret