Function at 0x4c7d80
Capabilities:
Decrypt data via sspi
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [ebx + 0x96], 0
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], esi
je 0x4c7fb3
mov ecx, dword [ebx + 0x204]
lea eax, [ebp - 0x60]
push eax
call fcn.004bf1d0
lea ecx, [ebp - 0x60]
mov bl, byte [eax + 4]
call fcn.004bdab0
test bl, bl
mov ebx, dword [ebp - 0x70]
je 0x4c7dd9
cmp byte [ebx + 0x210], 0
je 0x4c7fb3
mov ecx, dword [ebx + 0x224]
push 0
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0xc]
sub edx, eax
mov ecx, dword [ecx + 4]
push edx
add ecx, eax
push ecx
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
test edi, edi
jle 0x4c7f65
mov eax, dword [ebx + 0x224]
lea edx, [ebx + 0x214]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 4
add dword [eax + 0xc], edi
xor edi, edi
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov byte [ecx + eax], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x64], eax
nop dword [eax]
mov ecx, dword [ebx + 0x224]
push 0
push 0
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x6c]
push eax
push edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x4c7f46
test eax, eax
jne 0x4c7f43
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x70], esi
mov eax, dword [ebp - 0x74]
cmovb esi, dword [ebp - 0x70]
add eax, edi
push esi
push dword [ebp - 0x28]
push eax
call fcn.005190f0
mov edx, dword [ebp - 0x70]
add edi, esi
sub edx, esi
add esp, 0xc
cmp dword [ebp - 0x14], 5
mov esi, dword [ebx + 0x224]
mov dword [ebp - 0x70], edx
mov eax, dword [esi + 4]
jne 0x4c7f37
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
test ecx, ecx
jne 0x4c7ef9
mov dword [esi + 0xc], ecx
mov byte [eax], cl
jmp 0x4c7f1b
sub eax, ecx
add eax, dword [esi + 0xc]
push ecx
push eax
push dword [ebp - 0x78]
call fcn.005190f0
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
mov eax, dword [esi + 4]
mov edx, dword [ebp - 0x70]
mov dword [esi + 0xc], ecx
mov byte [ecx + eax], 0
mov eax, dword [ebx + 0x224]
cmp dword [eax + 0xc], 0
je 0x4c7f46
test edx, edx
lea edx, [ebx + 0x214]
jne 0x4c7e60
jmp 0x4c7f46
mov dword [esi + 0xc], 0
mov byte [eax], 0
jmp 0x4c7f46
or edi, 0xffffffff
mov eax, 0xffffd9b5
test edi, edi
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 8
je 0x4c7f50
cmp esi, 0x2733
je 0x4c7f9b
cmp esi, 0x8c
je 0x4c7f9b
cmp esi, 0xb
je 0x4c7f9b
cmp esi, 0x2734
je 0x4c7f9b
cmp esi, 0x70
je 0x4c7f9b
cmp esi, 0x2735
je 0x4c7f9b
cmp esi, 0x67
je 0x4c7f9b
cmp esi, 4
jne 0x4c7f50
mov ecx, dword [ebp - 4]
mov eax, 0xffffd9b5
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00517154
mov esp, ebp
pop ebp
ret 8
push 0
push dword [ebp + 0xc]
push esi
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
test edi, edi
jg 0x4c7f50
je 0x4c7f50
cmp esi, 0x2733
je 0x4c7f9b
cmp esi, 0x8c
je 0x4c7f9b
cmp esi, 0xb
je 0x4c7f9b
cmp esi, 0x2734
je 0x4c7f9b
cmp esi, 0x70
je 0x4c7f9b
cmp esi, 0x2735
je 0x4c7f9b
cmp esi, 0x67
je 0x4c7f9b
mov eax, 0xffffd9b5
cmp esi, 4
jmp 0x4c7f4d