Function at 0x4368fd
Capabilities:
Decrypt data via sspi
Receive data
Receive data on socket

Disassembly:
sub esp, 0x64
mov eax, dword [0x459c80]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, dword [esp + 0x74]
push ebp
mov ebp, dword [esp + 0x70]
push esi
push edi
xor esi, esi
mov dword [esp + 0x28], eax
push 0x30
lea eax, [esp + 0x44]
mov dword [esp + 0x20], ebp
push esi
push eax
mov dword [esp + 0x3c], ebx
mov edi, esi
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebp + 0x74]
add esp, 0xc
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov ecx, dword [edx + 0x18]
lea ebp, [edx + 0x30]
add ecx, dword [edx + 0x14]
add ecx, dword [edx + 0x10]
mov dword [esp + 0x2c], ecx
cmp dword [ebp + 4], esi
je 0x4369ac
mov esi, dword [ebp]
cmp ebx, esi
cmovb esi, ebx
push esi
push dword [ebp + 8]
push dword [esp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp]
add esp, 0xc
mov ecx, dword [ebp + 8]
cmp eax, ebx
jbe 0x436999
sub eax, ebx
push eax
lea eax, [ecx + ebx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
sub dword [ebp], ebx
jmp 0x436be0
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, ebp
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x436bdf
push ecx
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x4369d4
push 0x80090300
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x436be2
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x74]
add eax, 0x24
mov dword [esp + 0x24], eax
cmp dword [eax + 4], esi
je 0x436a13
push dword [eax]
push dword [eax + 8]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [esp + 0x30]
mov eax, dword [edi]
push dword [edi + 8]
mov dword [esp + 0x24], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
test edx, edx
je 0x436a23
cmp edi, 0x80090318
jne 0x436a4e
mov eax, dword [esp + 0x2c]
push esi
sub eax, edx
push eax
lea eax, [ecx + edx]
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x436bc3
mov edx, dword [esp + 0x14]
add edx, eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x40]
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x34]
push esi
push esi
push eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x44], 4
mov dword [esp + 0x50], 1
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0x74]
push dword [eax + 0xc]
call sub.Secur32.dll_DecryptMessage
mov edi, eax
cmp edi, 0x90317
je 0x436bd5
test edi, edi
je 0x436ac1
cmp edi, 0x90321
je 0x436ac1
cmp edi, 0x80090318
je 0x436a0f
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x436bd5
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x40]
mov ebx, dword [esp + 0x18]
push 4
pop edx
test ecx, ecx
jne 0x436adb
cmp dword [eax + 4], 1
cmove ecx, eax
test ebx, ebx
jne 0x436ae6
cmp dword [eax + 4], 5
cmove ebx, eax
add eax, 0xc
sub edx, 1
jne 0x436ad0
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
test eax, eax
je 0x436b37
mov ecx, dword [esp + 0x24]
mov dword [ecx + 4], 5
mov eax, dword [eax]
push eax
push 1
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [esp + 0x2c]
push dword [ecx]
mov dword [ecx + 8], eax
mov ecx, dword [esp + 0x24]
push dword [ecx + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x34]
add esp, 0x14
test ecx, ecx
jne 0x436b62
cmp edi, 0x90321
jne 0x436a0f
push esi
push esi
push dword [esp + 0x24]
call fcn.00436bf5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x436a0f
push edi
jmp 0x436ba2
mov edi, dword [ecx]
mov esi, ebx
cmp edi, ebx
cmovb esi, edi
push esi
push dword [ecx + 8]
push dword [esp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, ebx
jbe 0x436bd5
sub edi, ebx
xor eax, eax
inc eax
mov dword [ebp], edi
push edi
push eax
mov dword [ebp + 4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x436bad
push 0x80090300
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xfffffffffffffffe
pop esi
jmp 0x436bd5
mov eax, dword [esp + 0x20]
push edi
mov eax, dword [eax + 8]
add eax, ebx
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x436bd5
or esi, 0xffffffff
test eax, eax
jne 0x436bd5
push 0x2775
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00449662
add esp, 0x64
ret