Function at 0x9b8c90
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
push 0x2c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
push ebx
xor edi, edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x4c], ebx
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp dword [esi + 4], ebx
je 0x9b8f31
cmp ecx, ebx
jne 0x9b8ce2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x40]
cmp eax, ebx
jbe 0x9b8d36
mov edi, eax
cmp eax, ecx
jb 0x9b8cf1
mov edi, ecx
mov eax, dword [esi + 0x3c]
mov ecx, dword [ebp + 0xc]
push edi
push eax
push ecx
call fcn.009b2440
sub dword [esi + 0x40], edi
mov eax, dword [esi + 0x40]
jne 0x9b8d1f
mov edx, dword [esi + 0x3c]
push edx
call fcn.009b24a0
add esp, 4
mov eax, edi
pop edi
mov dword [esi + 0x3c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x3c]
push eax
lea eax, [esi + edi]
push eax
push esi
call fcn.009b2440
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
push ecx
push edx
call fcn.009b24e0
add esp, 8
cmp dword [ebp - 0x10], 0x80090318
je 0x9b8d5b
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x9b8f46
mov eax, dword [esi + 0x30]
cmp eax, ebx
jbe 0x9b8dac
cmp dword [esi + 0x2c], ebx
jne 0x9b8d6c
mov dword [esi + 0x30], ebx
jmp 0x9b8d46
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x38]
jbe 0x9b8d8a
mov ecx, dword [esi + 0x34]
push eax
push ecx
call fcn.009b2490
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
add esp, 8
mov dword [esi + 0x38], eax
mov edx, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x34]
push edx
push eax
call fcn.009b2440
mov ecx, dword [esi + 0x2c]
push ecx
call fcn.009b24a0
add esp, 4
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
jmp 0x9b8ddb
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
sub edx, edi
push edx
add eax, edi
push eax
push esi
call fcn.009b2bc0
mov edi, eax
add esp, 0xc
cmp edi, ebx
jg 0x9b8dd5
call sub.WS2_32.dll_WSAGetLastError
cmp dword [ebp - 8], ebx
je 0x9b8f46
add dword [ebp - 4], edi
mov edi, dword [ebp - 8]
add edi, dword [ebp - 4]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x40]
mov ecx, 3
lea esp, [esp]
mov dword [eax + 8], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
add eax, 0xc
sub ecx, 1
jne 0x9b8e00
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 8]
lea edx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], edx
call sub.Secur32.dll_DecryptMessage
mov dword [ebp - 0x10], eax
cmp eax, 0x80090318
je 0x9b8d46
cmp eax, ebx
jne 0x9b8f12
xor edi, edi
lea eax, [ebp - 0x40]
lea ecx, [edi + 3]
lea ecx, [ecx]
test edi, edi
jne 0x9b8e62
cmp dword [eax + 4], 1
jne 0x9b8e62
cmp dword [eax], edi
jbe 0x9b8e62
mov edi, eax
jmp 0x9b8e72
test ebx, ebx
jne 0x9b8e72
cmp dword [eax + 4], 5
jne 0x9b8e72
cmp dword [eax], ebx
jbe 0x9b8e72
mov ebx, eax
add eax, 0xc
sub ecx, 1
jne 0x9b8e50
test edi, edi
je 0x9b8ed2
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jbe 0x9b8ebe
mov edx, dword [esi + 0x3c]
sub eax, ecx
mov dword [esi + 0x40], eax
inc eax
push eax
push edx
mov dword [ebp - 4], ecx
call fcn.009b2490
add esp, 8
mov dword [esi + 0x3c], eax
test eax, eax
je 0x9b8f46
mov edx, dword [edi + 8]
mov ecx, dword [esi + 0x40]
add edx, dword [ebp + 0x10]
push ecx
push edx
push eax
call fcn.009b2440
mov eax, dword [ebp - 4]
jmp 0x9b8ec1
mov dword [ebp - 4], eax
add dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 8]
push eax
push ecx
call fcn.009b2440
test ebx, ebx
je 0x9b8f46
mov edx, dword [ebx]
mov eax, dword [esi + 0x2c]
inc edx
push edx
push eax
call fcn.009b2490
add esp, 8
mov dword [esi + 0x2c], eax
test eax, eax
je 0x9b8f46
mov ecx, dword [ebx]
mov edx, dword [esi + 0x34]
sub edx, ecx
add edx, dword [ebp - 8]
push ecx
push edx
push eax
call fcn.009b2440
mov eax, dword [ebx]
mov dword [esi + 0x30], eax
test edi, edi
jne 0x9b8f46
mov edi, dword [ebp - 8]
xor ebx, ebx
jmp 0x9b8d46
cmp eax, 0x90321
jne 0x9b8f46
push ebx
push ebx
push esi
call fcn.009b8790
add esp, 0xc
cmp eax, 1
jne 0x9b8f46
cmp dword [ebp - 0xc], ebx
jne 0x9b8f46
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call fcn.009b2bc0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret