Function at 0x41eff3
Capabilities:
Start http server

Disassembly:
push 0xb4
mov eax, 0x4aa467
call fcn.004a95a1
mov dword [ebp - 0xa0], ecx
mov eax, dword [0x4b70c8]
mov edi, 0x4066d8
cmp eax, 0x4b70c8
je 0x41f031
test byte [eax + 0x1c], 1
je 0x41f031
push dword [eax + 0x14]
mov edx, edi
mov ecx, 0x97
push dword [eax + 0x10]
call fcn.00416054
xor eax, eax
mov dword [ebp - 0x98], 0x401690
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], al
mov dword [ebp - 0xb4], 2
mov dword [ebp - 0xc0], 0x4016b4
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
xor ebx, ebx
lea ecx, [ebp - 0x90]
inc ebx
push 0x4b8970
mov byte [ebp - 4], bl
call fcn.00417475
xor eax, eax
mov byte [ebp - 4], 2
and dword [ebp - 0x8c], eax
mov word [ebp - 0x86], ax
lea eax, [ebp - 0x8c]
push eax
push 0x405cb8
mov word [ebp - 0x88], bx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov esi, eax
mov ebx, esi
neg ebx
sbb ebx, ebx
and ebx, 0xfffffac8
add ebx, 0x538
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f110
test byte [edx + 0x1c], 2
je 0x41f110
movzx ecx, byte [edx + 0x19]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41f110
push esi
push ebx
push dword [edx + 0x14]
mov ecx, 0x98
push dword [edx + 0x10]
mov edx, edi
call fcn.00417822
lea edi, [ebp - 0x24]
mov esi, 0x405250
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jne 0x41f359
push ecx
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x84]
call fcn.0041a652
push 3
push 0xf003f
push eax
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.0041aadd
movzx esi, al
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x9c], esi
mov byte [ebp - 4], 2
call fcn.0041a6cc
mov ebx, esi
neg ebx
sbb ebx, ebx
and ebx, 0xfffffac8
add ebx, 0x538
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f1b6
test byte [edx + 0x1c], 2
je 0x41f1b6
movzx eax, byte [edx + 0x19]
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 2
cmp eax, ecx
jb 0x41f1b6
push esi
push ebx
push dword [edx + 0x14]
mov ecx, 0x99
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.00417822
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x8c], 0
lea edi, [ebp - 0x24]
cmp dword [ebp - 0x9c], 0
mov esi, 0x405250
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x41f359
push ecx
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x98]
call fcn.0041b004
push ecx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x98]
call fcn.0041af93
test al, al
jne 0x41f211
mov ebx, 0x538
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f24f
test byte [edx + 0x1c], 2
je 0x41f24f
movzx ecx, byte [edx + 0x19]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41f24f
push ebx
push dword [edx + 0x14]
mov ecx, 0x9a
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
lea edi, [ebp - 0x24]
mov esi, 0x405250
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jne 0x41f359
push ebx
push 2
push dword [ebp - 0x88]
call dword [sym.imp.HTTPAPI.dll_HttpInitialize]
mov ebx, eax
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f2b0
test byte [edx + 0x1c], 2
je 0x41f2b0
movzx ecx, byte [edx + 0x19]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41f2b0
push ebx
push dword [edx + 0x14]
mov ecx, 0x9b
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
lea edi, [ebp - 0x24]
mov esi, 0x405240
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jne 0x41f359
push ebx
lea ecx, [ebp - 0x90]
call fcn.00417332
mov edx, eax
mov ecx, 0x405c50
call fcn.0041ee49
test eax, eax
jne 0x41f2f8
push ebx
lea ecx, [ebp - 0x90]
call fcn.00417332
mov edx, eax
mov ecx, 0x405d38
call fcn.0041ee49
push ebx
push 2
call dword [sym.imp.HTTPAPI.dll_HttpTerminate]
mov ebx, eax
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f345
test byte [edx + 0x1c], 2
je 0x41f345
movzx ecx, byte [edx + 0x19]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41f345
push ebx
push dword [edx + 0x14]
mov ecx, 0x9c
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
mov edx, dword [0x4b70c8]
lea edi, [ebp - 0x24]
mov esi, 0x405230
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x41f3de
push 0x4b8970
lea ecx, [ebp - 0x88]
call fcn.00417475
push ebx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 4
push 0x405818
push eax
call fcn.0041a5a1
mov edi, dword [ebp - 0xa0]
lea eax, [ebp - 0x24]
mov esi, dword [ebp - 0x88]
add esp, 0xc
mov ecx, edi
push 0
push esi
push dword [edi + 0x24]
push eax
call fcn.00417c6c
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x41f3d0
test byte [eax + 0x1c], 2
je 0x41f3d0
cmp byte [eax + 0x19], 2
jb 0x41f3d0
push ebx
push dword [edi + 0x24]
mov edx, 0x4066d8
mov ecx, 0x9d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00417794
lea ecx, [esi - 0x10]
call fcn.004174b0
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x41f416
test byte [edx + 0x1c], 1
je 0x41f416
movzx ecx, byte [edx + 0x19]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x41f416
push ebx
push dword [edx + 0x14]
mov ecx, 0x9e
push dword [edx + 0x10]
mov edx, 0x4066d8
call fcn.0041610f
mov ecx, dword [ebp - 0x90]
lea ecx, [ecx - 0x10]
call fcn.004174b0
lea ecx, [ebp - 0xc0]
call fcn.0041aaa2
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], 0x401690
call fcn.0041b2d0
mov eax, ebx
call fcn.004a9550
ret