Function at 0x100026a0
Capabilities:
Create process on windows
Encode data using xor
Link many functions at runtime
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10005e79
mov eax, dword fs:[0]
push eax
mov eax, 0x2150
call fcn.10005b80
mov eax, dword [0x10009018]
xor eax, esp
mov dword [esp + 0x2148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10009018]
xor eax, esp
push eax
lea eax, [esp + 0x2164]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2174]
xor ebx, ebx
push str.NewWebLogin.dll
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ecx
mov edi, edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
mov dword [esp + 0x50], ebp
cmp ebp, ebx
je 0x10002e1f
push str.load_dll
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Login
push ebp
call esi
push str.GetErrCode
push ebp
mov dword [esp + 0x4c], eax
call esi
push str.Logout
push ebp
mov dword [esp + 0x54], eax
call esi
push str.GetWebKey
push ebp
mov dword [0x10009540], eax
call esi
push str.SetCarUser
push ebp
call esi
mov edx, dword [0x10009518]
mov dword [esp + 0x48], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x10009518
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x216c], ebx
mov edx, dword [0x10009518]
mov eax, dword [edx + 0xc]
mov ecx, 0x10009518
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
mov byte [esp + 0x216c], 1
mov edx, dword [0x10009518]
mov eax, dword [edx + 0xc]
mov ecx, 0x10009518
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x216c], 2
mov edx, dword [0x10009518]
mov eax, dword [edx + 0xc]
mov ecx, 0x10009518
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
push 0xfff
lea ecx, [esp + 0x1161]
push ebx
mov byte [esp + 0x2174], 3
push ecx
mov byte [esp + 0x1168], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10006960
lea ecx, [esp + 0xc4]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push edi
lea ecx, [esp + 0xc4]
mov byte [esp + 0x2170], 4
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push 0x10006964
lea ecx, [esp + 0xc4]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp dword [esp + 0x44], ebx
je 0x10002d35
lea ecx, [esp + 0x20]
call fcn.10001e20
test al, al
je 0x10002d35
lea edx, [esp + 0x2c]
push edx
xor edi, edi
call fcn.10003b10
mov byte [esp + 0x216c], 5
mov esi, dword [esp + 0x20]
push 0x5c
push esi
call dword [sym.imp.MSVCR90.dll__mbsrchr]
add esp, 8
cmp eax, ebx
jne 0x10002873
or eax, 0xffffffff
jmp 0x10002875
sub eax, esi
inc eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
call fcn.10003a70
lea ebx, [esp + 0x14]
mov byte [esp + 0x216c], 6
call fcn.10003720
mov byte [esp + 0x216c], 5
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100028bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x14]
cmp dword [ebp - 4], 1
jle 0x100028d8
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.100015c0
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x2c]
mov ecx, ebp
call fcn.10001ee0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
sub ecx, eax
xor ebx, ebx
sar ecx, 2
mov dword [esp + 0x24], ebx
test ecx, ecx
jbe 0x10002cfe
cmp ebx, ecx
jb 0x1000290c
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x38]
lea ebp, [ebx*4]
add eax, ebp
push eax
call fcn.10003780
cmp eax, 3
jne 0x10002a92
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x38]
sar eax, 2
cmp ebx, eax
jb 0x10002939
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + ebp]
sub eax, 0x10
mov dword [esp + 0x5c], esp
mov esi, esp
call fcn.10003d50
add eax, 0x10
mov dword [esi], eax
call fcn.100020c0
add esp, 4
test al, al
jne 0x10002a92
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x38]
sar edx, 2
cmp ebx, edx
jb 0x10002979
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x38]
mov eax, dword [eax + ebp]
push ecx
sub eax, 0x10
mov dword [esp + 0x5c], esp
mov esi, esp
call fcn.10003d50
add eax, 0x10
mov dword [esi], eax
call fcn.10002170
mov esi, eax
add esp, 4
cmp esi, edi
jle 0x10002a92
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x38]
sar ecx, 2
cmp ebx, ecx
jb 0x100029bb
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [esp + 0x38]
lea eax, [edx + ebp]
lea ebx, [esp + 0x28]
call fcn.10003720
mov ebx, dword [esp + 0x20]
push 0x5c
push ebx
call dword [sym.imp.MSVCR90.dll__mbsrchr]
add esp, 8
test eax, eax
jne 0x100029e4
or eax, 0xffffffff
jmp 0x100029e6
sub eax, ebx
inc eax
lea ecx, [esp + 0x54]
lea edx, [esp + 0x20]
call fcn.10003a70
lea ebx, [esp + 0x14]
mov byte [esp + 0x216c], 7
call fcn.10003720
mov byte [esp + 0x216c], 5
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x38]
sar ecx, 2
cmp dword [esp + 0x24], ecx
jb 0x10002a44
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [esp + 0x38]
mov ecx, dword [edx + ebp]
mov eax, dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x18]
push ecx
call fcn.100013c0
lea eax, [esp + 0x14]
lea ebx, [esp + 0x1c]
call fcn.10003720
push str.NCSidentifier.p12
mov edx, ebx
push edx
mov eax, 0x13
call fcn.100013c0
push str.purple_zone
lea eax, [esp + 0x18]
push eax
mov eax, 0xc
call fcn.100013c0
mov ebx, dword [esp + 0x24]
mov edi, esi
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
sub ecx, eax
inc ebx
sar ecx, 2
mov dword [esp + 0x24], ebx
cmp ebx, ecx
jb 0x1000290c
test edi, edi
jle 0x10002cfa
push 0x1000
lea ecx, [esp + 0x1160]
push 0
push ecx
call sub.MSVCR90.dll_memset
mov esi, dword [esp + 0x34]
mov edi, 1
add esp, 0xc
cmp dword [esi - 4], edi
jle 0x10002aeb
mov edx, dword [esi - 0xc]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.100015c0
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x14]
cmp dword [ebp - 4], edi
jle 0x10002b06
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.100015c0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp dword [eax - 4], edi
jle 0x10002b21
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.100015c0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x5c]
mov edi, dword [esp + 0x60]
push esi
push ebp
push eax
push edx
push edi
call dword [esp + 0x5c]
lea eax, [esp + 0x1170]
add esp, 0x14
push eax
call dword [esp + 0x48]
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
jne 0x10002b63
mov dword [esp + 0x18], 0xb
call dword [0x10009540]
mov eax, dword [esp + 0x38]
jmp 0x10002cfe
cmp esi, 1
jle 0x10002ce6
call dword [esp + 0x4c]
cmp eax, ebx
jne 0x10002cd6
push 0xfff
lea ecx, [esp + 0x161]
push ebx
push ecx
mov byte [esp + 0x168], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x15c]
push edx
push esi
lea ecx, [esp + 0x1164]
call fcn.100025f0
push 0x7f
mov esi, eax
lea eax, [esp + 0xe9]
push ebx
push eax
mov byte [esp + 0xf0], 0
call sub.MSVCR90.dll_memset
add esp, 0x14
push edi
lea ecx, [esp + 0xe0]
push 0x80
push ecx
call dword [sym.imp.MSVCR90.dll_strcpy_s]
lea eax, [esp + 0xe8]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002bf0
sub eax, edx
xor ecx, ecx
mov edi, eax
cmp esi, ebx
jbe 0x10002c1a
xor edx, edx
mov eax, ecx
div edi
inc ecx
mov dl, byte [esp + edx + 0xdc]
xor byte [esp + ecx + 0x15b], dl
cmp ecx, esi
jb 0x10002c01
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0xc4]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov eax, dword [esp + 0xc4]
mov esi, 0x10
cmp dword [esp + 0xd8], esi
jae 0x10002c4b
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x40
lea ecx, [esp + 0x7c]
push ebx
push ecx
mov dword [esp + 0x80], ebx
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x64], ebx
cmp dword [esp + 0xd8], esi
jae 0x10002c92
lea eax, [esp + 0xc4]
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x78]
push ecx
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10002cc2
mov edx, dword [esp + 0x70]
mov dword [esp + 0x18], edx
call dword [0x10009540]
mov eax, dword [esp + 0x38]
jmp 0x10002cfe
mov dword [esp + 0x18], 0xc
call dword [0x10009540]
mov eax, dword [esp + 0x38]
jmp 0x10002cfe
mov dword [esp + 0x18], eax
call dword [0x10009540]
mov eax, dword [esp + 0x38]
jmp 0x10002cfe
mov dword [esp + 0x18], 0xd
call dword [0x10009540]
mov eax, dword [esp + 0x38]
jmp 0x10002cfe
mov ebp, dword [esp + 0x14]
xor esi, esi
cmp eax, esi
je 0x10002d1a
mov edi, dword [esp + 0x3c]
call fcn.10003e20
mov eax, dword [esp + 0x38]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
mov edx, dword [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc0]
mov byte [esp + 0x216c], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov byte [esp + 0x216c], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002d7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x216c], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002da5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x216c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002dc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x216c], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002df3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2164]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2148]
xor ecx, esp
call fcn.10004e0a
add esp, 0x215c
ret
mov eax, 0xe
jmp 0x10002df7