Function at 0x1005f390
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using xor
Get socket status
Hash data with md5
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098ad9
mov eax, dword fs:[0]
push eax
sub esp, 0x5b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x558], esi
mov eax, dword [ebp + 8]
push 0
push 1
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x580], 1
mov dword [ebp - 0x5bc], 0xb4
mov dword [ebp - 0x5b8], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x12c], eax
cmp eax, 0xffffffff
jne 0x1005f42f
push 0x100c97a8
lea eax, [ebp - 0x5ac]
mov dword [ebp - 0x5ac], 0x6a
push eax
call fcn.1008220d
mov eax, dword [ebp + 0xc]
test ax, ax
je 0x1005f445
mov edi, dword [sym.imp.WS2_32.dll_htons]
push eax
call edi
movzx eax, ax
jmp 0x1005f469
push 0
push str.mail
call dword [sym.imp.WS2_32.dll_getservbyname]
mov edi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
jne 0x1005f465
push 0x19
call edi
movzx eax, ax
jmp 0x1005f469
movzx eax, word [eax + 8]
push eax
mov dword [ebp - 0x560], eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xorps xmm0, xmm0
mov dword [ebp - 0x550], eax
mov eax, 2
movdqu xmmword [ebp - 0x2c4], xmm0
mov word [ebp - 0x2c4], ax
movzx eax, word [esi + 0x138]
test ax, ax
jne 0x1005f4f9
mov eax, dword [ebp - 0x560]
mov edi, dword [ebp - 0x554]
push edi
mov word [ebp - 0x2c2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x2c0], eax
cmp eax, 0xffffffff
jne 0x1005f543
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1005f52a
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0x69
push eax
call fcn.1008220d
push eax
call edi
push dword [esi + 0x134]
mov word [ebp - 0x2c2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x2c0], eax
cmp eax, 0xffffffff
jne 0x1005f543
push dword [esi + 0x134]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1005f587
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x2c0]
push eax
call fcn.10086400
add esp, 0xc
lea eax, [ebp - 0x580]
push eax
push 0x8004667e
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1005f5ae
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x5a8]
mov dword [ebp - 0x5a8], 0x6c
push eax
call fcn.1008220d
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x598]
mov dword [ebp - 0x598], 0x69
push eax
call fcn.1008220d
push 0x10
lea eax, [ebp - 0x2c4]
push eax
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1005fbc6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1005f600
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x588]
mov dword [ebp - 0x588], 0x68
push eax
call fcn.1008220d
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
jmp 0x1005f610
mov eax, dword [esi + 0x12c]
lea ecx, [ebp - 0x5bc]
push ecx
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x548], eax
push ecx
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x444], eax
push ecx
push 0
inc eax
mov dword [ebp - 0x54c], 1
push eax
mov dword [ebp - 0x448], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1005f681
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x5a0]
mov dword [ebp - 0x5a0], 0x6d
push eax
call fcn.1008220d
test eax, eax
jne 0x1005f6ac
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x193
push eax
call fcn.1008220d
lea eax, [ebp - 0x54c]
push eax
push dword [esi + 0x12c]
call edi
test eax, eax
je 0x1006155c
cmp word [esi + 0x138], 0
je 0x1005f712
push dword [ebp - 0x550]
mov edx, dword [ebp - 0x554]
mov ecx, dword [esi + 0x12c]
call fcn.1005f1e0
add esp, 4
test eax, eax
jne 0x1005f712
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x56c], 0x69
push eax
call fcn.1008220d
mov edx, dword [ebp - 0x54c]
xor ecx, ecx
test edx, edx
je 0x1005f763
mov eax, dword [esi + 0x12c]
cmp dword [ebp + ecx*4 - 0x548], eax
je 0x1005f734
inc ecx
cmp ecx, edx
jb 0x1005f724
jmp 0x1005f763
lea eax, [edx - 1]
cmp ecx, eax
jae 0x1005f75c
jmp 0x1005f740
mov eax, dword [ebp + ecx*4 - 0x544]
mov dword [ebp + ecx*4 - 0x548], eax
inc ecx
mov edx, dword [ebp - 0x54c]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1005f740
dec edx
mov dword [ebp - 0x54c], edx
mov edx, dword [ebp - 0x448]
xor ecx, ecx
test edx, edx
je 0x1005f7b3
mov eax, dword [esi + 0x12c]
cmp dword [ebp + ecx*4 - 0x444], eax
je 0x1005f785
inc ecx
cmp ecx, edx
jb 0x1005f775
jmp 0x1005f7b3
lea eax, [edx - 1]
cmp ecx, eax
jae 0x1005f7ac
lea esp, [esp]
mov eax, dword [ebp + ecx*4 - 0x440]
mov dword [ebp + ecx*4 - 0x444], eax
inc ecx
mov edx, dword [ebp - 0x448]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1005f790
dec edx
mov dword [ebp - 0x448], edx
mov eax, dword [ebp + 0x10]
cmp eax, 3
je 0x1005f7c1
mov dword [esi + 0x168], eax
mov eax, dword [esi + 0x168]
cmp eax, 1
je 0x1005f7d1
cmp eax, 2
jne 0x1005f81e
call fcn.10002820
call fcn.10003390
call fcn.10003380
push eax
call fcn.100023a0
add esp, 4
mov dword [esi + 0x16c], eax
test eax, eax
jne 0x1005f80e
push 0x100c97a8
lea eax, [ebp - 0x570]
mov dword [ebp - 0x570], 0x19e
push eax
call fcn.1008220d
cmp dword [esi + 0x168], 2
jne 0x1005f81e
mov ecx, esi
call fcn.10063010
xor edx, edx
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], edx
je 0x1005f839
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005f824
jmp 0x1005f843
lea eax, [ecx + ecx*4]
lea edx, [eax*4 + 0x100db750]
push edx
mov ecx, esi
call fcn.10062b70
mov ecx, esi
call fcn.100626f0
cmp dword [esi + 0x168], 1
jne 0x1005f869
mov ecx, esi
call fcn.100627f0
mov ecx, esi
call fcn.100626f0
cmp byte [ebp + 0x14], 0
je 0x1005fbc6
mov ecx, dword [esi + 0x128]
mov edx, str.AUTH
call fcn.1005d4a0
cmp al, 1
jne 0x1005fbc6
xor edi, edi
je 0x1005f8b6
cmp byte [edi], 0
jne 0x1005f898
xor ecx, ecx
jmp 0x1005f8a9
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f8a0
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0xd4]
call fcn.100638e0
cmp dword [esi + 0xe4], edi
jne 0x1005f8d9
push 0x100c97a8
lea eax, [ebp - 0x57c]
mov dword [ebp - 0x57c], 0xcc
push eax
call fcn.1008220d
xor edi, edi
je 0x1005f906
cmp byte [edi], 0
jne 0x1005f8e6
xor ecx, ecx
jmp 0x1005f8f9
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x1005f8f0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f8f0
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0xec]
call fcn.100638e0
cmp dword [esi + 0xfc], edi
jne 0x1005f929
push 0x100c97a8
lea eax, [ebp - 0x584]
mov dword [ebp - 0x584], 0xcd
push eax
call fcn.1008220d
mov ecx, dword [esi + 0x128]
mov edx, str.LOGIN
call fcn.1005d4a0
cmp al, 1
jne 0x1005fbeb
xor edi, edi
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], 3
je 0x1005f95d
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005f947
jmp 0x1005f967
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_LOGIN_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [esi + 0xe8], 0x10
lea ecx, [esi + 0xd4]
jb 0x1005f9a0
mov ecx, dword [ecx]
mov edx, dword [esi + 0xe4]
lea eax, [ebp - 0x19c]
push 0x100
push eax
call fcn.1005ce50
add esp, 8
cmp eax, 0x100
jae 0x1005fbe6
mov byte [ebp + eax - 0x19c], 0
cmp byte [ebp - 0x19c], 0
mov dword [ebp - 0x200], 0xf
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
jne 0x1005f9f5
xor ecx, ecx
jmp 0x1005fa09
lea ecx, [ebp - 0x19c]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fa00
sub ecx, edx
push ecx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x214]
call fcn.100638e0
xor edi, edi
mov byte [ebp - 4], 1
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], 7
je 0x1005fa3c
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fa26
jmp 0x1005fa46
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
cmp dword [ebp - 0x200], 0x10
lea eax, [ebp - 0x214]
cmovae eax, dword [ebp - 0x214]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
jb 0x1005fa94
mov ecx, dword [ecx]
mov edx, dword [esi + 0xfc]
lea eax, [ebp - 0x19c]
push 0x100
push eax
call fcn.1005ce50
add esp, 8
cmp eax, 0x100
jae 0x1005fbe6
mov byte [ebp + eax - 0x19c], 0
cmp byte [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jne 0x1005fae9
xor ecx, ecx
jmp 0x1005fafb
lea ecx, [ebp - 0x19c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005faf2
sub ecx, edx
push ecx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
xor edi, edi
mov byte [ebp - 4], 2
xor ecx, ecx
xor eax, eax
jmp 0x1005fb20
cmp dword [eax + 0x100db750], 8
je 0x1005fb36
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fb20
jmp 0x1005fb40
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
cmp dword [ebp - 0x1a0], 0x10
lea eax, [ebp - 0x1b4]
cmovae eax, dword [ebp - 0x1b4]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x10
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x1a0], 0x10
jb 0x1005fb94
push dword [ebp - 0x1b4]
call fcn.1007b706
add esp, 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jb 0x1005fbc6
push dword [ebp - 0x214]
call fcn.1007b706
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret 0x18
call fcn.1007b843
mov ecx, dword [esi + 0x128]
mov edx, str.PLAIN
call fcn.1005d4a0
cmp al, 1
jne 0x1005fd3d
xor ecx, ecx
mov dword [ebp - 0x554], edi
xor eax, eax
lea ecx, [ecx]
cmp dword [eax + 0x100db750], 2
je 0x1005fc26
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fc10
jmp 0x1005fc36
lea eax, [ecx + ecx*4]
lea eax, [eax*4 + 0x100db750]
mov dword [ebp - 0x554], eax
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
jb 0x1005fc47
mov ecx, dword [ecx]
cmp dword [esi + 0xe8], 0x10
lea eax, [esi + 0xd4]
jb 0x1005fc5a
mov edx, dword [eax]
jmp 0x1005fc5c
mov edx, eax
cmp dword [eax + 0x14], 0x10
jb 0x1005fc64
mov eax, dword [eax]
push ecx
push edx
push eax
push str._s_s_s
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
mov ecx, dword [esi + 0x124]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fc88
sub ecx, edx
mov edx, edi
mov dword [ebp - 0x55c], ecx
je 0x1005fcb5
jmp 0x1005fca0
mov eax, dword [esi + 0x124]
cmp byte [edx + eax], 0x5e
jne 0x1005fcb0
mov byte [edx + eax], 0
inc edx
cmp edx, ecx
jb 0x1005fca0
add ecx, 2
mov eax, 0x55555556
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x55c]
mov ecx, dword [esi + 0x124]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
push edi
push str.AUTH_PLAIN__s_r_n
push 0x2800
mov byte [edi + eax], 0
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x18
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x554]
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
jmp 0x1005fbc6
mov ecx, dword [esi + 0x128]
mov edx, str.CRAM_MD5
call fcn.1005d4a0
cmp al, 1
jne 0x1006050a
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x1005fd60
cmp dword [eax + 0x100db750], 4
je 0x1005fd76
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fd60
jmp 0x1005fd80
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_CRAM_MD5_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
mov edx, dword [esi + 0x128]
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
cmp byte [edx], 0
jne 0x1005fdd2
xor ecx, ecx
jmp 0x1005fde0
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fdd7
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x22c]
call fcn.100638e0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x22c]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x22c]
cmp eax, edi
je 0x1005fe99
cmp dword [ebp - 0x218], 0x10
jb 0x1005fe2e
push dword [ebp - 0x22c]
call fcn.1007b706
add esp, 4
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
cmp dword [edi + 0x14], 0x10
jae 0x1005fe68
mov eax, dword [edi + 0x10]
inc eax
je 0x1005fe76
push eax
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.1007a990
add esp, 0xc
jmp 0x1005fe76
mov eax, dword [edi]
mov dword [ebp - 0x22c], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x21c], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x218], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1a0], 0x10
jb 0x1005feb0
push dword [ebp - 0x1b4]
call fcn.1007b706
add esp, 4
mov eax, dword [ebp - 0x21c]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
inc eax
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x22c]
mov edx, dword [ebp - 0x21c]
cmovae ecx, dword [ebp - 0x22c]
push ecx
push eax
mov dword [ebp - 0x554], eax
call fcn.1005cf20
mov edx, dword [ebp - 0x554]
add esp, 8
mov byte [edx + eax], 0
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
cmp byte [edx], 0
jne 0x1005ff2d
xor ecx, ecx
jmp 0x1005ff45
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x550], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ff38
sub ecx, dword [ebp - 0x550]
push ecx
push edx
lea ecx, [ebp - 0x1e4]
call fcn.100638e0
mov eax, dword [ebp - 0x554]
push eax
push 0
mov byte [ebp - 4], 4
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi + 0xfc]
mov dword [ebp - 0x558], eax
cmp eax, 0x40
jle 0x1006000b
push 0x11
push 0
call edi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
cmp dword [esi + 0x100], 0x10
lea edx, [esi + 0xec]
mov edi, eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
jb 0x1005ffda
mov edx, dword [edx]
push dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
add esp, 4
lea ecx, [ebp - 0x2b4]
mov edx, edi
call fcn.100760b0
mov byte [edi + 0x10], 0
mov dword [ebp - 0x558], 0x10
jmp 0x1006003e
inc eax
push eax
push 0
call edi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
mov edi, eax
jb 0x1006002c
mov ecx, dword [ecx]
mov edx, edi
mov edi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x10060030
push 0x40
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.10081610
push 0x40
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.10081610
push dword [ebp - 0x558]
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.10086400
push dword [ebp - 0x558]
lea eax, [ebp - 0x308]
push edi
push eax
call fcn.10086400
movdqa xmm1, xmmword [str.6666666666666666H]
add esp, 0x30
movdqa xmm2, xmmword [0x100c71f0]
xor eax, eax
lea esp, [esp]
movdqu xmm0, xmmword [ebp + eax - 0x9c]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x9c], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x308]
pxor xmm0, xmm2
movdqu xmmword [ebp + eax - 0x308], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x8c]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x8c], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x2f8]
pxor xmm0, xmm2
movdqu xmmword [ebp + eax - 0x2f8], xmm0
add eax, 0x20
cmp eax, 0x40
jl 0x100600a0
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x11
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x40
lea edx, [ebp - 0x9c]
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.10075ff0
cmp dword [ebp - 0x1d0], 0x10
lea edx, [ebp - 0x1e4]
push dword [ebp - 0x1d4]
cmovae edx, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
mov edx, dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
call fcn.100760b0
mov eax, dword [ebp - 0x558]
lea edx, [ebp - 0x308]
push 0x40
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov byte [eax + 0x10], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.10075ff0
mov edx, dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
push 0x10
call fcn.10075ff0
add esp, 0x10
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x2b4]
call fcn.100760b0
xor eax, eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x564], ecx
jmp 0x10060230
movzx eax, byte [ebp + eax - 0x4c]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x554]
add esp, 0xc
mov ecx, dword [ebp - 0x564]
inc eax
add ecx, 2
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x564], ecx
cmp eax, 0x10
jl 0x10060230
cmp byte [ebp - 0x38], 0
jne 0x10060270
xor ecx, ecx
jmp 0x1006027f
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060276
sub ecx, edx
push ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.100638e0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x558]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ecx
lea edx, [esi + 0xd4]
lea ecx, [ebp - 0x214]
call fcn.10064290
add esp, 4
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x1b4]
call fcn.10064350
mov edi, eax
add esp, 4
lea eax, [ebp - 0x1e4]
cmp eax, edi
je 0x10060374
cmp dword [ebp - 0x1d0], 0x10
jb 0x10060309
push dword [ebp - 0x1e4]
call fcn.1007b706
add esp, 4
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
cmp dword [edi + 0x14], 0x10
jae 0x10060343
mov eax, dword [edi + 0x10]
inc eax
je 0x10060351
push eax
lea eax, [ebp - 0x1e4]
push edi
push eax
call fcn.1007a990
add esp, 0xc
jmp 0x10060351
mov eax, dword [edi]
mov dword [ebp - 0x1e4], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1d4], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x1d0], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1a0], 0x10
jb 0x1006038b
push dword [ebp - 0x1b4]
call fcn.1007b706
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jb 0x100603c1
push dword [ebp - 0x214]
call fcn.1007b706
add esp, 4
mov ecx, dword [ebp - 0x1d4]
mov eax, 0x55555556
lea ecx, [ecx + 2]
imul ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x1d0], 0x10
lea ecx, [ebp - 0x1e4]
mov edx, dword [ebp - 0x1d4]
cmovae ecx, dword [ebp - 0x1e4]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
add esp, 8
mov byte [edi + eax], 0
cmp byte [edi], 0
jne 0x10060426
xor ecx, ecx
jmp 0x10060439
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x10060430
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060430
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x22c]
call fcn.100638e0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x218], 0x10
lea eax, [ebp - 0x22c]
cmovae eax, dword [ebp - 0x22c]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x10
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 8
je 0x100604a6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x10060490
jmp 0x100604b0
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x1d0], 0x10
jb 0x100604d7
push dword [ebp - 0x1e4]
call fcn.1007b706
add esp, 4
cmp dword [ebp - 0x218], 0x10
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
jb 0x1005fbc6
push dword [ebp - 0x22c]
jmp 0x1005fbbe
mov ecx, dword [esi + 0x128]
mov edx, str.DIGEST_MD5
call fcn.1005d4a0
cmp al, 1
jne 0x10061533
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x10060530
cmp dword [eax + 0x100db750], 6
je 0x10060546
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x10060530
jmp 0x10060550
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_DIGEST_MD5_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
mov edx, dword [esi + 0x128]
mov dword [ebp - 0x230], 0xf
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x244], 0
cmp byte [edx], 0
jne 0x100605a2
xor ecx, ecx
jmp 0x100605b0
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100605a7
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x244]
call fcn.100638e0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x244]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x244]
cmp eax, edi
je 0x10060666
cmp dword [ebp - 0x230], 0x10
jb 0x100605fb
push dword [ebp - 0x244]
call fcn.1007b706
add esp, 4
mov dword [ebp - 0x230], 0xf
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x244], 0
cmp dword [edi + 0x14], 0x10
jae 0x10060635
mov eax, dword [edi + 0x10]
inc eax
je 0x10060643
push eax
lea eax, [ebp - 0x244]
push edi
push eax
call fcn.1007a990
add esp, 0xc
jmp 0x10060643
mov eax, dword [edi]
mov dword [ebp - 0x244], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x234], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x230], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060677
push dword [ebp - 0x30]
call fcn.1007b706
add esp, 4
mov eax, dword [ebp - 0x234]
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x230], 0x10
lea ecx, [ebp - 0x244]
mov edx, dword [ebp - 0x234]
mov edi, eax
cmovae ecx, dword [ebp - 0x244]
push ecx
push edi
call fcn.1005cf20
add esp, 8
mov byte [edi + eax], 0
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
cmp byte [edi], 0
jne 0x100606e8
xor ecx, ecx
jmp 0x100606f9
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100606f0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
push edi
push 0
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 5
push ecx
push str.nonce
lea ecx, [ebp - 0x1b4]
call fcn.100637f0
test eax, eax
jns 0x1006074c
push 0x100c97a8
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x58c], 0xcf
push eax
call fcn.1008220d
push 0xffffffffffffffff
add eax, 7
lea ecx, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.10063250
push 1
push ecx
push 0x100c5dbc
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 8
call fcn.100637f0
test eax, eax
jns 0x1006079a
push 0x100c97a8
lea eax, [ebp - 0x594]
mov dword [ebp - 0x594], 0xcf
push eax
call fcn.1008220d
push eax
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1fc]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1fc]
cmp eax, edi
je 0x1006083e
cmp dword [ebp - 0x1e8], 0x10
jb 0x100607d3
push dword [ebp - 0x1fc]
call fcn.1007b706
add esp, 4
mov dword [ebp - 0x1e8], 0xf
mov dword [ebp - 0x1ec], 0
mov byte [ebp - 0x1fc], 0
cmp dword [edi + 0x14], 0x10
jae 0x1006080d
mov eax, dword [edi + 0x10]
inc eax
je 0x1006081b
push eax
lea eax, [ebp - 0x1fc]
push edi
push eax
call fcn.1007a990
add esp, 0xc
jmp 0x1006081b
mov eax, dword [edi]
mov dword [ebp - 0x1fc], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1ec], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x1e8], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1c], 0x10
jb 0x1006084f
push dword [ebp - 0x30]
call fcn.1007b706
add esp, 4
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
push 5
push ecx
push str.realm
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 9
call fcn.100637f0
test eax, eax
js 0x10060998
push 0xffffffffffffffff
add eax, 7
lea ecx, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1cc]
cmp eax, edi
je 0x100608e8
cmp dword [ebp - 0x1b8], 0x10
jb 0x100608c1
push dword [ebp - 0x1cc]
call fcn.1007b706
add esp, 4
push edi
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x100608f9
push dword [ebp - 0x30]
call fcn.1007b706
add esp, 4
push 1
push ecx
push 0x100c5dbc
lea ecx, [ebp - 0x1cc]
call fcn.100637f0
test eax, eax
jns 0x1006092b
push 0x100c97a8
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0xcf
push eax
call fcn.1008220d
push eax
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1cc]
cmp eax, edi
je 0x10060987
cmp dword [ebp - 0x1b8], 0x10
jb 0x10060960
push dword [ebp - 0x1cc]
call fcn.1007b706
add esp, 4
push edi
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060998
push dword [ebp - 0x30]
call fcn.1007b706
add esp, 4
push 0
call fcn.1007bc09
push eax
push 0x100c5dc8
lea eax, [ebp - 0x4c]
push 0x11
push eax
call fcn.1007a967
push 1
push str._08d
lea eax, [ebp - 0x58]
push 9
push eax
call fcn.1007a967
add esp, 0x24
mov dword [ebp - 0x200], 0xf
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
push 4
push str.auth
call fcn.100638e0
lea eax, [ebp - 0x5a4]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x5a4], 0x80
push eax
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x10060a39
push 0x100c97a8
lea eax, [ebp - 0x568]
mov dword [ebp - 0x568], 0xd0
push eax
call fcn.1008220d
push dword [ebp - 0x340]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
cmp byte [edx], 0
jne 0x10060a6b
xor ecx, ecx
jmp 0x10060a79
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060a70
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x25c]
call fcn.100638e0
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x30]
call fcn.100643d0
mov edi, eax
add esp, 4
lea eax, [ebp - 0x25c]
cmp eax, edi
je 0x10060ae6
cmp dword [ebp - 0x248], 0x10
jb 0x10060abf
push dword [ebp - 0x25c]
call fcn.1007b706
add esp, 4
push edi
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060af7
push dword [ebp - 0x30]
call fcn.1007b706
add esp, 4
push 0x11
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [esi + 0xe8], 0x10
lea edi, [esi + 0xd4]
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
jb 0x10060b5d
mov edx, dword [edi]
jmp 0x10060b5f
mov edx, edi
push dword [esi + 0xe4]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
cmp dword [ebp - 0x1b8], 0x10
lea edx, [ebp - 0x1cc]
push dword [ebp - 0x1bc]
cmovae edx, dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
lea edx, [esi + 0xec]
add esp, 0x10
cmp dword [edx + 0x14], 0x10
jb 0x10060bca
mov edx, dword [edx]
push dword [esi + 0xfc]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
mov edx, dword [ebp - 0x560]
lea ecx, [ebp - 0x2b4]
add esp, 4
call fcn.100760b0
mov eax, dword [ebp - 0x560]
push 0x21
push 0
mov byte [eax + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x560]
lea ecx, [ebp - 0x2b4]
push 0x10
mov dword [ebp - 0x564], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
cmp dword [ebp - 0x1e8], 0x10
lea edx, [ebp - 0x1fc]
push dword [ebp - 0x1ec]
cmovae edx, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
lea ecx, [ebp - 0x4c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060cb1
sub ecx, edx
lea edx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
add esp, 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.100760b0
mov ecx, dword [ebp - 0x564]
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x55c], ecx
mov edi, edi
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x554]
add esp, 0xc
mov ecx, dword [ebp - 0x55c]
inc eax
add ecx, 2
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x55c], ecx
cmp eax, 0x10
jl 0x10060cf0
push 0x21
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0xd
mov edx, str.AUTHENTICATE:
mov dword [ebp - 0x554], eax
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.10075ff0
cmp dword [ebp - 0x248], 0x10
lea edx, [ebp - 0x25c]
push dword [ebp - 0x24c]
cmovae edx, dword [ebp - 0x25c]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
add esp, 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.100760b0
mov ecx, dword [ebp - 0x554]
xor eax, eax
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x550], ecx
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x55c]
add esp, 0xc
mov ecx, dword [ebp - 0x550]
inc eax
add ecx, 2
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x550], ecx
cmp eax, 0x10
jl 0x10060dd5
push dword [ebp - 0x560]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x564]
lea ecx, [ebp - 0x2b4]
push 0x20
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
cmp dword [ebp - 0x1e8], 0x10
lea edx, [ebp - 0x1fc]
push dword [ebp - 0x1ec]
cmovae edx, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
lea ecx, [ebp - 0x58]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060ec1
sub ecx, edx
lea edx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
lea ecx, [ebp - 0x4c]
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060ef4
sub ecx, edx
lea edx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
cmp dword [ebp - 0x200], 0x10
lea edx, [ebp - 0x214]
push dword [ebp - 0x204]
cmovae edx, dword [ebp - 0x214]
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
push 1
mov edx, 0x100c5de4
lea ecx, [ebp - 0x2b4]
call fcn.10075ff0
mov edx, dword [ebp - 0x554]
lea ecx, [ebp - 0x2b4]
push 0x20
call fcn.10075ff0
add esp, 0x14
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.100760b0
xor eax, eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x55c], ecx
lea ebx, [ebx]
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x550]
add esp, 0xc
mov ecx, dword [ebp - 0x55c]
inc eax
add ecx, 2
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x55c], ecx
cmp eax, 0x10
jl 0x10060f90
cmp byte [ebp - 0x7c], 0
jne 0x10060fd0
xor ecx, ecx
jmp 0x10060fdf
lea ecx, [ebp - 0x7c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060fd6
sub ecx, edx
push ecx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
push dword [ebp - 0x564]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x554]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.charset
push dword [esi + 0x128]
call fcn.1007afe0
add esp, 8
cmp dword [edi + 0x14], 0x10
jb 0x10061034
mov edi, dword [edi]
push edi
push str.charsetutf_8_username__s_
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x10
cmp dword [ebp - 0x1bc], 0
je 0x100610c3
cmp dword [ebp - 0x1b8], 0x10
lea eax, [ebp - 0x1cc]
cmovae eax, dword [ebp - 0x1cc]
push eax
push str._realm__s_
push 0x2800
push dword [esi + 0x128]
call fcn.1007a967
mov edx, dword [esi + 0x128]
add esp, 0x10
mov ecx, edx
mov dword [ebp - 0x550], ecx
mov al, byte [edx]
inc edx
test al, al
jne 0x10061091
mov edi, dword [esi + 0x124]
sub edx, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100610a1
mov esi, dword [ebp - 0x550]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x558]
cmp dword [ebp - 0x1e8], 0x10
lea eax, [ebp - 0x1fc]
cmovae eax, dword [ebp - 0x1fc]
push eax
push str._nonce__s_
push 0x2800
push dword [esi + 0x128]
call fcn.1007a967
mov edx, dword [esi + 0x128]
add esp, 0x10
mov ecx, edx
mov dword [ebp - 0x550], ecx
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x10061100
mov edi, dword [esi + 0x124]
sub edx, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10061110
mov esi, dword [ebp - 0x550]
lea eax, [ebp - 0x58]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov eax, dword [ebp - 0x558]
mov ecx, edx
push str._nc_s
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x2800
push dword [eax + 0x128]
call fcn.1007a967
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
lea esp, [esp]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061160
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061170
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c]
push ecx
push str._cnonce__s_
push 0x2800
push dword [eax + 0x128]
call fcn.1007a967
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100611b0
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100611c0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x248], 0x10
lea ecx, [ebp - 0x25c]
cmovae ecx, dword [ebp - 0x25c]
push ecx
push str._digest_uri__s_
push 0x2800
push dword [eax + 0x128]
call fcn.1007a967
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061211
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061221
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x1a0], 0x10
lea ecx, [ebp - 0x1b4]
cmovae ecx, dword [ebp - 0x1b4]
push ecx
push str._response_s
push 0x2800
push dword [eax + 0x128]
call fcn.1007a967
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061272
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061282
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x200], 0x10
lea ecx, [ebp - 0x214]
cmovae ecx, dword [ebp - 0x214]
push ecx
push str._qop_s
push 0x2800
push dword [eax + 0x128]
call fcn.1007a967
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100612d3
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100612e3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x558]
mov ecx, dword [esi + 0x124]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10061308
sub ecx, edx
mov eax, 0x55555556
mov dword [ebp - 0x55c], ecx
add ecx, 2
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x55c]
mov ecx, dword [esi + 0x124]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
add esp, 8
mov byte [edi + eax], 0
cmp byte [edi], 0
jne 0x10061367
xor ecx, ecx
jmp 0x10061379
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10061370
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x244]
call fcn.100638e0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x230], 0x10
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0x10
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 6
je 0x100613e6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x100613d0
jmp 0x100613f0
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
push 0x100c5bac
push 0x2800
push dword [esi + 0x124]
call fcn.1007a967
add esp, 0xc
xor edi, edi
xor ecx, ecx
xor eax, eax
mov edi, edi
cmp dword [eax + 0x100db750], 8
je 0x10061436
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x10061420
jmp 0x10061440
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x248], 0x10
jb 0x10061467
push dword [ebp - 0x25c]
call fcn.1007b706
add esp, 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
jb 0x10061499
push dword [ebp - 0x214]
call fcn.1007b706
add esp, 4
cmp dword [ebp - 0x1b8], 0x10
mov dword [ebp - 0x200], 0xf
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
jb 0x100614cb
push dword [ebp - 0x1cc]
call fcn.1007b706
add esp, 4
cmp dword [ebp - 0x1e8], 0x10
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
jb 0x100614fd
push dword [ebp - 0x1fc]
call fcn.1007b706
add esp, 4
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x1e8], 0xf
mov dword [ebp - 0x1ec], 0
mov byte [ebp - 0x1fc], 0
call fcn.10063220
lea ecx, [ebp - 0x244]
call fcn.10063220
jmp 0x1005fbc6
push 0x1a1
lea ecx, [ebp - 0x55c]
call fcn.1005d210
push 0x100c97a8
mov eax, dword [eax]
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x5b4]
push eax
call fcn.1008220d
lea eax, [ebp - 0x448]
push eax
push dword [esi + 0x12c]
call edi
test eax, eax
je 0x1005f610
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97a8
lea eax, [ebp - 0x578]
mov dword [ebp - 0x578], 0x6d
push eax
call fcn.1008220d
mov ecx, dword [ebp - 0x5b0]
mov eax, dword [ecx + 0x128]
cmp byte [eax], 0x35
jne 0x100615be
cmp byte [eax + 1], 0x33
jne 0x100615be
cmp byte [eax + 2], 0x30
jne 0x100615be
mov byte [ecx + 0x130], 0
call fcn.100615d0
push 0
push 0
call fcn.1008220d
int3