Function at 0x411149
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435476
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x448d60]
xor eax, ebp
mov dword [ebp - 0x14c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
cmp dword [0x45239c], 0
je 0x410131
cmp dword [0x4523a8], 0
jne 0x4101b6
mov eax, dword [ebp + 0x24]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x4101b1
push 0xfff
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push 0x437e3c
push 0
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x34], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x410195
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x410195
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4101ab
push 0
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
jmp 0x411509
mov ecx, dword [ebp + 8]
call fcn.00418d30
add eax, 4
mov ecx, eax
call fcn.00418a20
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [0x4523a8]
je 0x410262
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x41025d
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0x437e6c
push 0x437ea4
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x410241
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x410241
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ec50
add esp, 0x1c
jmp 0x410257
push 0
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x24]
mov byte [edx], 1
jmp 0x411509
mov eax, dword [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4102fe
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x4102f9
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
push 0x437ec4
push 0x1f4
call fcn.0040e760
add esp, 0x10
mov dword [ebp - 0x3c], eax
movzx edx, byte [ebp + 0x28]
test edx, edx
je 0x4102dd
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x4102dd
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4102f3
push 0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0x24]
mov byte [ecx], 1
jmp 0x411509
mov ecx, dword [ebp + 8]
call fcn.00418d30
mov dword [ebp - 0x2a0], eax
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4103bf
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x4103ba
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x437edc
push 0x193
mov eax, dword [ebp + 8]
push eax
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x40], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x41039e
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x41039e
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4103b4
push 0
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
jmp 0x411509
mov ecx, dword [0x4523a8]
push ecx
mov edx, dword [0x45239c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042af6d
add esp, 0xc
test eax, eax
je 0x410469
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x410464
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
push 0x437f04
push 0x437f3c
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x44], eax
movzx edx, byte [ebp + 0x28]
test edx, edx
je 0x410448
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x410448
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ec50
add esp, 0x1c
jmp 0x41045e
push 0
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0x24]
mov byte [ecx], 1
jmp 0x411509
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x410509
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x410504
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
push 0x437f60
push 0x193
call fcn.0040e760
add esp, 0x10
mov dword [ebp - 0x48], eax
movzx edx, byte [ebp + 0x28]
test edx, edx
je 0x4104e8
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x4104e8
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4104fe
push 0
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0x24]
mov byte [ecx], 1
jmp 0x411509
push 0
push 1
push 0
mov edx, dword [0x452378]
push edx
call dword [sym.imp.CRYPT32.dll_CertControlStore]
test eax, eax
jne 0x410534
push 0x437f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
push 0
push 1
push 0
mov eax, dword [0x451e44]
push eax
call dword [sym.imp.CRYPT32.dll_CertControlStore]
test eax, eax
jne 0x41055e
push 0x437fa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x25], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0xf5], 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0xc0000
push 0
push 1
mov edx, dword [0x451e44]
push edx
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4105ba
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0xc0000
push 0
push 1
mov ecx, dword [0x452378]
push ecx
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov dword [ebp - 0x18], eax
jmp 0x4105c1
mov byte [ebp - 0xf5], 1
cmp dword [ebp - 0x18], 0
jne 0x41067a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80092004
je 0x4105ec
push 0x437fb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x410675
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0x437fd4
push 0
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0xfc], eax
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x410656
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x410656
mov edx, dword [ebp - 0xfc]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ec50
add esp, 0x1c
jmp 0x41066f
push 0
mov ecx, dword [ebp - 0xfc]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x24]
mov byte [edx], 1
jmp 0x41142a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
jne 0x4106b5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call fcn.0042af6d
add esp, 0xc
test eax, eax
jne 0x4106b5
mov dword [ebp - 0x2a4], 1
jmp 0x4106bf
mov dword [ebp - 0x2a4], 0
mov al, byte [ebp - 0x2a4]
mov byte [ebp - 0x49], al
lea ecx, [ebp - 0x9c]
call fcn.00418a40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.0041fee6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4107a7
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x410790
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0x437ff4
push 0x438018
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x100], eax
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x410771
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x410771
mov edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ec50
add esp, 0x1c
jmp 0x41078a
push 0
mov ecx, dword [ebp - 0x100]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x24]
mov byte [edx], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x41142a
lea ecx, [ebp - 0xf4]
call fcn.00418a40
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0xf4]
call fcn.0041fee6
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x410895
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x41086f
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x43802c
push 0x193
mov eax, dword [ebp + 8]
push eax
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x104], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x410850
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x410850
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x410869
push 0
mov edx, dword [ebp - 0x104]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00419570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x41142a
push 1
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0xf4]
call fcn.00420dd4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x41096f
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x410949
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0x43804c
push 0x193
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x108], eax
movzx edx, byte [ebp + 0x28]
test edx, edx
je 0x41092a
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x41092a
mov ecx, dword [ebp - 0x108]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ec50
add esp, 0x1c
jmp 0x410943
push 0
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0x24]
mov byte [ecx], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00419570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x41142a
mov dword [ebp - 0xa0], 0
movzx edx, byte [ebp - 0xf5]
test edx, edx
je 0x410991
mov eax, dword [0x451e44]
mov dword [ebp - 0x2a8], eax
jmp 0x41099d
mov ecx, dword [0x452378]
mov dword [ebp - 0x2a8], ecx
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x2a8]
push ecx
call dword [sym.imp.CRYPT32.dll_CertFindCRLInStore]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x120], 0
cmp dword [ebp - 0xa0], 0
jne 0x410ca9
cmp dword [ebp - 0x20], 0
jne 0x410ca9
push 0
push 0
push 0
lea edx, [ebp - 0x130]
push edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 2
call dword [sym.imp.CRYPTNET.dll_CryptGetObjectUrl]
test eax, eax
jne 0x410a27
cmp dword [ebp - 0x20], 0
je 0x410a0e
jmp 0x411385
push 0x438074
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
jmp 0x411385
mov ecx, dword [ebp - 0x130]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x410ad5
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x410ad0
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0x438088
push 0x1f4
call fcn.0040e760
add esp, 0x10
mov dword [ebp - 0x138], eax
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x410ab1
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x410ab1
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ec50
add esp, 0x1c
jmp 0x410aca
push 0
mov ecx, dword [ebp - 0x138]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x24]
mov byte [edx], 1
jmp 0x411385
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 2
call dword [sym.imp.CRYPTNET.dll_CryptGetObjectUrl]
test eax, eax
jne 0x410b1f
cmp dword [ebp - 0x20], 0
je 0x410b06
jmp 0x411385
push 0x4380a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
jmp 0x411385
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x410b4f
push 0x4380b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
jmp 0x410c2f
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x410b79
push 0x4380c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
jmp 0x410c2f
mov dword [ebp - 0x13c], 0
jmp 0x410b94
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x13c]
cmp ecx, dword [eax]
jae 0x410c11
mov dword [ebp - 0x140], 0x493e0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x140]
push eax
push 0
push 2
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [edx + eax*4]
push ecx
call dword [sym.imp.CRYPTNET.dll_CryptRetrieveObjectByUrlW]
test eax, eax
je 0x410be7
jmp 0x410c11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5b4
jne 0x410bf8
mov byte [ebp - 0x11], 1
push 0x4380e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
jmp 0x410b85
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x410c2f
push 0x4380fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xa0], 0
jne 0x410c4a
jmp 0x411385
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x410c63
mov ecx, dword [0x451e44]
mov dword [ebp - 0x2ac], ecx
jmp 0x410c6f
mov edx, dword [0x452378]
mov dword [ebp - 0x2ac], edx
push 0
push 3
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x2ac]
push ecx
call dword [sym.imp.CRYPT32.dll_CertAddCRLContextToStore]
test eax, eax
jne 0x410c9f
push 0x43810c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e240
add esp, 8
mov dword [ebp - 0x120], 1
cmp dword [ebp - 0xa0], 0
jne 0x410cb7
jmp 0x411385
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 0
push 0x451f48
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x4523c8]
mov dword [ebp - 0x114], edx
mov eax, dword [0x4523cc]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x128], 0
jmp 0x410d0c
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
cmp dword [ebp - 0x128], 5
jge 0x410dff
mov edx, dword [ebp - 0x128]
imul edx, edx, 0x50
mov eax, dword [ebp - 0xa0]
mov ecx, dword [edx + 0x4523c0]
cmp ecx, dword [eax + 8]
jne 0x410d8b
mov edx, dword [ebp - 0x128]
imul edx, edx, 0x50
cmp dword [edx + 0x4523c4], 0
je 0x410d8b
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x128]
imul ecx, ecx, 0x50
mov edx, dword [ecx + 0x4523c4]
push edx
call fcn.0042af6d
add esp, 0xc
test eax, eax
jne 0x410d8b
mov eax, dword [ebp - 0x128]
imul eax, eax, 0x50
add eax, 0x4523d0
mov dword [ebp - 0x118], eax
jmp 0x410dff
cmp dword [ebp - 0x128], 0
jle 0x410dfa
mov ecx, dword [ebp - 0x128]
imul ecx, ecx, 0x50
mov dword [ebp - 0x2b0], ecx
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x110]
cmp eax, dword [edx + 0x4523cc]
jl 0x410dfa
jg 0x410dcd
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x114]
cmp edx, dword [ecx + 0x4523c8]
jbe 0x410dfa
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x128]
imul ecx, ecx, 0x50
mov edx, dword [ecx + 0x4523c8]
mov dword [ebp - 0x114], edx
mov eax, dword [ecx + 0x4523cc]
mov dword [ebp - 0x110], eax
jmp 0x410cfd
cmp dword [ebp - 0x118], 0
jne 0x410fd9
mov ecx, dword [ebp - 0x124]
imul ecx, ecx, 0x50
cmp dword [ecx + 0x4523c4], 0
je 0x410e47
mov edx, dword [ebp - 0x124]
imul edx, edx, 0x50
mov eax, dword [edx + 0x4523c4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x124]
imul ecx, ecx, 0x50
mov dword [ecx + 0x4523c4], 0
mov edx, dword [ebp - 0x124]
imul edx, edx, 0x50
add edx, 0x4523d0
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x118]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x410f33
push 0x451f48
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x410f2e
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x438128
push 0x193
mov eax, dword [ebp + 8]
push eax
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x144], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x410f0f
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x410f0f
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x410f28
push 0
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
jmp 0x411385
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0x124]
imul ecx, ecx, 0x50
mov dword [ecx + 0x4523c4], eax
mov edx, dword [ebp - 0x124]
imul edx, edx, 0x50
cmp dword [edx + 0x4523c4], 0
jne 0x410f76
push 0x451f48
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x411385
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xa0]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x124]
imul ecx, ecx, 0x50
mov edx, dword [ecx + 0x4523c4]
push edx
call fcn.0042a7e0
add esp, 0xc
mov eax, dword [ebp - 0x124]
imul eax, eax, 0x50
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 8]
mov dword [eax + 0x4523c0], edx
push 0
call fcn.00411590
add esp, 4
mov ecx, dword [ebp - 0x124]
imul ecx, ecx, 0x50
mov dword [ecx + 0x4523c8], eax
mov dword [ecx + 0x4523cc], edx
push 0x451f48
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [ebp - 0x9c]
push edx
mov ecx, dword [ebp - 0x118]
call fcn.00420996
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x41109b
mov eax, dword [ebp + 0x24]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x411096
push 0xfff
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push str.CRL
push 0x193
mov edx, dword [ebp + 8]
push edx
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x148], eax
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x411077
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x411077
mov edx, dword [ebp - 0x148]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ec50
add esp, 0x1c
jmp 0x411090
push 0
mov ecx, dword [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp + 0x24]
mov byte [edx], 1
jmp 0x411385
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0xf4]
push edx
mov ecx, dword [ebp - 0x118]
call fcn.0041f935
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x411377
cmp dword [ebp - 0x2c], 0xffffffea
jne 0x4112c3
mov byte [ebp - 0x25], 1
push 0x40
lea eax, [ebp - 0x28c]
push eax
push 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
add edx, 0x30
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.CRYPT32.dll_CertNameToStrA]
cmp dword [ebp - 0x11c], 0
je 0x41120a
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x2b4], edx
mov eax, dword [ebp - 0x2b4]
sub eax, 1
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 9
ja case.0x411142.6
mov ecx, dword [ebp - 0x2b4]
jmp dword [ecx*4 + 0x411560]
mov dword [ebp - 0x290], 0x438158
jmp 0x4111bf
mov dword [ebp - 0x290], 0x438170
jmp 0x4111bf
mov dword [ebp - 0x290], 0x438184
jmp 0x4111bf
mov dword [ebp - 0x290], 0x4381a0
jmp 0x4111bf
mov dword [ebp - 0x290], 0x4381b4
jmp 0x4111bf
mov dword [ebp - 0x290], 0x4381cc
jmp 0x4111bf
mov dword [ebp - 0x290], 0x4381e4
jmp 0x4111bf
mov dword [ebp - 0x290], str._privilege_withdrawn
jmp 0x4111bf
mov dword [ebp - 0x290], str._AA_compromise
jmp 0x4111bf
mov dword [ebp - 0x290], 0x43641b
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x290]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x11c]
add edx, 2
push edx
mov eax, dword [ebp - 0x11c]
add eax, 4
push eax
lea ecx, [ebp - 0x28c]
push ecx
push 0x43821c
push 0x100
lea edx, [ebp - 0x24c]
push edx
call fcn.0042ab41
add esp, 0x24
jmp 0x41122a
lea eax, [ebp - 0x28c]
push eax
push 0x43824c
push 0x100
lea ecx, [ebp - 0x24c]
push ecx
call fcn.0042ab41
add esp, 0x10
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x4112bc
push 0xfff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0x438264
lea eax, [ebp - 0x24c]
push eax
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x294], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x41129d
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x41129d
mov eax, dword [ebp - 0x294]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4112b6
push 0
mov edx, dword [ebp - 0x294]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
jmp 0x411385
cmp dword [ebp - 0x2c], 0xffffffeb
je 0x4112cf
cmp dword [ebp - 0x2c], 0xffffffec
jne 0x4112e2
cmp dword [ebp - 0x120], 0
je 0x4112dd
jmp 0x411385
jmp 0x410979
mov ecx, dword [ebp + 0x24]
movzx edx, byte [ecx]
test edx, edx
jne 0x411375
push 0xfff
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x438280
push 0x193
mov eax, dword [ebp + 8]
push eax
call fcn.0040e7f0
add esp, 0x18
mov dword [ebp - 0x298], eax
movzx ecx, byte [ebp + 0x28]
test ecx, ecx
je 0x411356
movzx edx, byte [ebp - 0x12]
test edx, edx
jne 0x411356
mov eax, dword [ebp - 0x298]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ec50
add esp, 0x1c
jmp 0x41136f
push 0
mov edx, dword [ebp - 0x298]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
jmp 0x411385
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x410979
movzx edx, byte [ebp - 0x2d]
test edx, edx
je 0x411394
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
je 0x4113a2
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x4113c5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00419570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x41142a
movzx ecx, byte [ebp - 0x49]
test ecx, ecx
je 0x4113f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00419570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x41142a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x2d], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00419570
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00419570
jmp 0x410566
movzx ecx, byte [ebp - 0x25]
test ecx, ecx
je 0x411437
jmp 0x411509
cmp dword [ebp - 0x20], 0
jne 0x4114f3
mov edx, dword [ebp + 0x24]
movzx eax, byte [edx]
test eax, eax
jne 0x4114f1
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x411463
mov dword [ebp - 0x2b8], 0x438318
jmp 0x41146d
mov dword [ebp - 0x2b8], 0x4382ec
push 0xfff
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push 0x4382b8
mov ecx, dword [ebp - 0x2b8]
push ecx
push 0x193
call fcn.0040e380
add esp, 0x14
mov dword [ebp - 0x29c], eax
movzx edx, byte [ebp + 0x28]
test edx, edx
je 0x4114d2
movzx eax, byte [ebp - 0x12]
test eax, eax
jne 0x4114d2
mov ecx, dword [ebp - 0x29c]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040ec50
add esp, 0x1c
jmp 0x4114eb
push 0
mov eax, dword [ebp - 0x29c]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0x24]
mov byte [ecx], 1
jmp 0x411509
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, 1
jmp 0x411543
cmp dword [ebp - 0x1c], 0
je 0x411519
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10], 0
je 0x411531
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x18]
je 0x411531
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
cmp dword [ebp - 0x18], 0
je 0x411541
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14c]
xor ecx, ebp
call fcn.0042a637
mov esp, ebp
pop ebp
ret