Function at 0x10021f3a
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1be0
call fcn.10030170
mov eax, dword [0x10069410]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x1be0], eax
mov eax, dword [0x1006a748]
push edi
mov dword [ebp - 0x1bd8], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1bdc], edx
push 0x7ff
push eax
mov byte [ebp - 0xbec], al
lea eax, [ebp - 0xbeb]
push eax
mov dword [ebp - 0x1bd4], esi
call fcn.1002d750
add esp, 0xc
cmp dword [0x1006ef44], 5
jl 0x10021fad
push str.HandleWebPages
call fcn.1001fbc0
pop ecx
test edi, edi
je 0x100226a4
test ebx, ebx
je 0x100226a4
cmp dword [ebp - 0x1bdc], 0
je 0x100226a4
test esi, esi
je 0x100226a4
mov eax, dword [ebp - 0x1bd4]
xor esi, esi
push 0xf
push str._intersect.gif
push edi
mov dword [eax], esi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002203f
mov eax, dword [ebp - 0x1bd4]
push 0xffffffffffffffff
push str.R0lGODlhzQBGALMAAB8aF01JR2toZtwrGYFfONVRoMi5eWleuCePKzrLOysszLy_jRzunl5f____j29SwAAAAAzQBGAEAI_gAdCBxIsKDBgw4eIFxIUCHDhxAjSkT4AMGAAQgmatw40CHHjxs9ghQJsuTEBxdTpkxgsqXLlzBjyvyoMuXMmzAB6NQp0MDOnzoDkOz504ADn0CTAniAVOlOoQqcSgVqdKpVAARrXiyA0XQkkCJ7jRakMDPAA3MjmUYtikAsgfV6lTw9WFYgwKACj34gIFWjF0DCx5MeGPUsw08WtTKMqFcAGgZNghQ9ChQAQ1Kuq36s7DnzxL7_kXw4DFah6gFpk4o8ADVBwpjs45d1_Lau6Bz6y5YQCvXmbV3CxMUHvvxcZHFSgoOGB5g4WGFhAfUFmAwqqL2i94EGDAwSZ_nNXreDA9gXmq5vvmb165sDBIcYnfjAB8gLz6ev3upifa0i5VeYgCEtROBIsyUIm0GyseZgbatFqNqEBB2nUkb9BXbXZgJN9hN0YukE10FtVYbQY1clxVmKSjW0WE0HZijRhiYetIBSAdjVGYcUPZAXi0Bth9tBHv4EnkEWqjQUU5SxKMB2HTEFpJBXrTiVjFhO9F9NGKIIpE7g8ahZZUNmaeZGL6rUkQJNfgllQmyyCKJBHJZ55p0LNZBkSr8VhN4D66mGnkGBEjRdRwcUetQB7zmwHnraBYqddo3ieecDe2IUo6WcdtrRlkp6KuqoqmH6F34ZbkrqpZkOoOqq_7DqZmpNjcVqK55_VSrjqyR2BmdSkSHEoVtS2TbVXkVCQB0yho5EKgp6XorQmFJudZjBJAkZq87GfvWQo_NKWyN8jnQwJDQXlTrtNT6KuYDN_6UmLcjGlTiWic2K68Ds5VEEqYcmrve6S21GbKrK1o8EdndsvAN3ZqRrCAAiAUJopKcfuTQ0oYMChGwsU709vCuRXwAMl2x7FF9FpVVWFhsyfMRaPBByDj0mwMc898wzwgZYK2JLdfo6s4ytKqSzz0z3zGiIbw1cdLdH75rpbz_qC2XWci40NU9Vy4jxRWGX_dnYA6zLWgPW8fUvTEtS5KDZoD2QLp_LpYceiP6DFqRoT1BpxBzDk33HV2PHkloon_TLRhyKzkuuWB9JYnh5C8N7OndgOmnOeaUN3DfgqCb9DmenDd6eulho315qpfSLRpjq7NOd6av244gf2fRXpH9UONh_6W78RpmqPXfIuMHbZAAEzMvXsCkKLdVesBnQslRPDtSv4g6MjWqWtd_lMLDSQm0UsU5565RQD2zPYmYPL9XhXwl4JHx_NJ71k83A2xbBuiVAgpgmfSkDmmGGhLb9Yal_Q3MAwsBHL4URkGEDWVrTeqbADW6QYvo7FfliAsFvdShIhcOg9xaGr7jUDzwPyxFB7pY_s5WwXocJynVUKJB7RZBBGv70oNPeQxWfcU1E3TlIAx24nxsy6IhUsSBPCphBxDyIQqvpodEKckQZHkSEsMtJwVpYkPMlpWQDnCIPHQDFKfFri2WkWL1MNpoeXfGOEIINbRS0PBKO8YfL0QsCV3hBMiIkTsqKGBwNYkZ_FQRtDBCJyoAEovi56QEpiln7jheRHO4EjUkbiCebZZSRTQmTVXqjVTg5EdecxSMnq0mfwgUR6j1FamRaJCs5ogAC9OxNaGuMl760vqLg8ja63CXcTqW0u3QkBz5GlaU2RVIluZDH3GLAAg0FGlSsysA45K56tedRqaILuNCJtWeRPxqaaNKUqiJSlZF2ys53FA6nePY3nzgLtM2TeqeM_jxdLGDHIYJim0GsQ5K2pQyNDhVZZuClnTdVlKED1UhsGNCqAWjMOdspj0ekQyc0OupNzBHcQJ5zKECdZ0QONQ8TOVkRyA1AV94xAOMSZYD3DEokMvVbEj2203mt5wHMOVTfBJId7ugvoxJBm0qUZ66IdqhtbKNUdCoq0ehUCl6ZsWrbKKodh1x0kFAliFQL8NG0lm5LCJAe3QICADs
push 0x7ed
mov dword [eax], 2
lea eax, [ebp - 0x1bcc]
push eax
call fcn.10001f89
lea edx, [ebp - 0x1bcc]
lea ecx, [ebp - 0x13dc]
call fcn.1002a9d9
mov esi, eax
lea eax, [ebp - 0x13dc]
push esi
push eax
push ebx
call fcn.1002f070
add esp, 0x1c
mov eax, esi
jmp 0x100226a6
push 0xe
push str._critical.gif
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022092
mov eax, dword [ebp - 0x1bd4]
push 0xffffffffffffffff
push str.R0lGODlhDQAOAKUhAAQEBDMAABwcHGYAACkpKUJCQmYzM01NTZkzM1VVVV9fX8wzM2ZmZswzZplmM5lmZnd3d8xmM8xmZoaGhv9mZpaWlsyZZv98gMyZmfZZvZmcDAwP_MmdfX1__MzOfn1vHx8f___________________________________________________________________________________________________________________________yH5BAEKAD8ALAAAAAANAA4AAAZ8wJ_wxxAABIfhkFGYbDqbiUIxhBAwH5D2UzlMhAaHBIPRkCUPwyNQDQkkkikbWAjFgu4fEEP3OEUFxQUEXwDAxESgReMgnEDBgiNGpQZjBF1kheUnIwIDxMGZRocpZQWn2sGEhoeHhwaEg4PQ2kPEhYPumpKPwkGwLxCQQA7
push 0x1d5
mov dword [eax], 2
lea eax, [ebp - 0x1e4]
push eax
call fcn.10001f89
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x3ec]
call fcn.1002a9d9
mov esi, eax
lea eax, [ebp - 0x3ec]
jmp 0x1002202d
push 0xe
push str._priority.gif
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100220e8
mov eax, dword [ebp - 0x1bd4]
push 0xffffffffffffffff
push str.R0lGODlhDQAOAKUlAAQEBBwcHDMzM2YzAEJCQmYzM5kzAE1NTZkzM8wzAF9fX2ZmM8wzM2ZmZplmM5lmZnd3d8xmAMxmM8xmZoaGhv9mM8yZM8yZZq2pkMyZmfZM_ZZsDAwP_MZv_MmdfX1__MzO_Wxufn1v__zP_78P___________________________________________________________________________________________________________yH5BAEKAD8ALAAAAAANAA4AAAZ2wJ_w1wgAAofhsEGgcD4cikIxhAgyIJKINMIUKMKBY7LxmC8XxDnMEgYkrglbjCoDYl4ZVRRBADA3oaG4UafRKBcYUdHYZ9ioVmHo2FEnYIkpMehQ4OFAUXm2aOCBc_D6EeISFnnkMPCA5oaQ4LSkIFurpKQQA7
push 0x1cd
mov dword [eax], 2
lea eax, [ebp - 0x1dc]
push eax
call fcn.10001f89
lea edx, [ebp - 0x1dc]
lea ecx, [ebp - 0x3e4]
call fcn.1002a9d9
mov esi, eax
lea eax, [ebp - 0x3e4]
jmp 0x1002202d
push 0xd
push str._warning.gif
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002213e
push 0xffffffffffffffff
push str.R0lGODlhDQAOAKUjABwcHCkpKTMzM2YzAEJCQmYzM5kzAJkzM1VVVWZmM2ZmZplmM5lmZnd3d8xmM8xmZoaGhpmZM5mZZpaWlsyZM8yZZvZM_ZZszMZszMmf_MM8zMzP_MZv_Mmd3d3efn1v__Zv__mf_78P___________________________________________________________________________________________________________________yH5BAEKAD8ALAAAAAANAA4AAAZ9wJ_w1wAEBIjhUNFgeDybSQMybBQkos8nKyk0hIdHpUPucCqLw49xcFAoFYzm7TgcCu63Zv6mOAYFFBYWGhwce4MWBgUVh4aPiAsLjY8gII4XCwyNliGelhwUDBILGJ2enhgLEj8JpaipEQtDCQkRGRkYEhEJSkIJBMG9Q0EAOw
mov eax, dword [ebp - 0x1bd4]
push 0x1d9
mov dword [eax], 2
lea eax, [ebp - 0x1ec]
push eax
call fcn.10001f89
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x3ec]
call fcn.1002a9d9
mov esi, eax
lea eax, [ebp - 0x3ec]
jmp 0x1002202d
push 0xa
push str._info.gif
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002215b
push 0xffffffffffffffff
push str.R0lGODlhDQAOAKUjAAwMDBwcHAAzACIiIikpKTMzADMzMzk5OUJCQjNmM1VVVV9fX2ZmMzOZM3d3d2aZM2aZZoaGhpmZZmbMM2bMZpnMM5nMZrKyspnMmcDAwMzMmZn_Zt3d3cz_Zsz_mefn1urq6vHx8f__zP___________________________________________________________________________________________________________________yH5BAEKAD8ALAAAAAANAA4AAAZ9wJ_wpxgACIrh0LGIXDiZiMKxPEQoBDoEzFQf4SEBKPBmCELAjGReEAo8MmjwTa0H4JXv5IBAp4ExaDFRV8AgUQExUWG44bjBAFCRCDGx2YG4MSCQwPFpgeHpgdFg8MEQwWoqyiFqg_nqsirKYLQ55jGhYSp0pCCMFsSkEAOw
jmp 0x10022103
push 0xb
push str._clear.gif
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100221b1
mov eax, dword [ebp - 0x1bd4]
push 0xffffffffffffffff
push str.R0lGODlhDQAOAIQVAAwMDCIiIikpKUJCQk1NTVVVVV9fX2ZmZnd3d4aGhpaWlpmZmaCgpLKyssDAwMzMzNfX193d3ePj4rq6vHx8f___________________________________________yH5BAEKAB8ALAAAAAANAA4AAAVx4CdRwAIxzgexfJATzMkI3IwkkRRUGMgolnjFYn0EIVP4dZoOJ6OJoIwWDSh0QYjQShcIeBw03BwPIq5HMxxODQiksmOMpFEGonEW1fp0ydbeQ99hH0PeSQKEYUVEgpAImQMEBMQDAgGKiIFA50EKiEAOw
push 0x149
mov dword [eax], 2
lea eax, [ebp - 0x35c]
push eax
call fcn.10001f89
lea edx, [ebp - 0x35c]
lea ecx, [ebp - 0x15c]
call fcn.1002a9d9
mov esi, eax
lea eax, [ebp - 0x15c]
jmp 0x1002202d
push 8
push str._MD5.js
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100221f9
mov eax, dword [ebp - 0x1bd4]
push 0xffffffffffffffff
push str.__n__MD5__Message_Digest_Algorithm__n__http:__www.webtoolkit.info__n__nvar_MD5function_string_function_RotateLeft_lValue_iShiftBits_return_lValue__iShiftBits__lValue____32_iShiftBits__function_AddUnsigned_lX_lY_var_lX4_lY4_lX8_lY8_lResult_lX8_lX0x80000000__lY8_lY0x80000000__lX4_lX0x40000000__lY4_lY0x40000000__lResult_lX0x3FFFFFFF__lY0x3FFFFFFF__if_lX4lY4_return_lResult0x80000000lX8lY8_if_lX4lY4_if_lResult0x40000000_return_lResult0xC0000000lX8lY8_elsereturn_lResult0x40000000lX8lY8_elsereturn_lResultlX8lY8_function_F_x_y_z_return_xy___x_z_function_G_x_y_z_return_xz__y_z__function_H_x_y_z_return_xyz_function_I_x_y_z_return_y_x_z___function_FF_a_b_c_d_x_s_ac_aAddUnsigned_a_AddUnsigned_AddUnsigned_F_b_c_d__x__ac___return_AddUnsigned_RotateLeft_a_s__b__function_GG_a_b_c_d_x_s_ac_aAddUnsigned_a_AddUnsigned_AddUnsigned_G_b_c_d__x__ac___return_AddUnsigned_RotateLeft_a_s__b__function_HH_a_b_c_d_x_s_ac_aAddUnsigned_a_AddUnsigned_AddUnsigned_H_b_c_d__x__ac___return_AddUnsigned_RotateLeft_a_s__b__function_II_a_b_c_d_x_s_ac_aAddUnsigned_a_AddUnsigned_AddUnsigned_I_b_c_d__x__ac___return_AddUnsigned_RotateLeft_a_s__b__function_ConvertToWordArray_string_var_lWordCount_var_lMessageLengthstring.length_var_lNumberOfWords_temp1lMessageLength8_var_lNumberOfWords_temp2_lNumberOfWords_temp1__lNumberOfWords_temp1_64___64_var_lNumberOfWords_lNumberOfWords_temp21_16_var_lWordArrayArray_lNumberOfWords_1__var_lBytePosition0_var_lByteCount0_while_lByteCount_lMessageLength_lWordCount_lByteCount__lByteCount_4___4_lBytePosition_lByteCount_4_8_lWordArray_lWordCount__lWordArray_lWordCount__string.charCodeAt_lByteCount___lBytePosition___lByteCountlWordCount_lByteCount__lByteCount_4___4_lBytePosition_lByteCount_4_8_lWordArray_lWordCount_lWordArray_lWordCount__0x80__lBytePosition__lWordArray_lNumberOfWords_2_lMessageLength__3_lWordArray_lNumberOfWords_1_lMessageLength___29_return_lWordArray_function_WordToHex_lValue_var_WordToHexValue___WordToHexValue_temp___lByte_lCount_for_lCount0_lCount_3_lCount_lByte_lValue____lCount8__255_WordToHexValue_temp_0_lByte.toString_16__WordToHexValueWordToHexValueWordToHexValue_temp.substr_WordToHexValue_temp.length_2_2_return_WordToHexValue_function_Utf8Encode_string_stringstring.replace___r_n_g___n___var_utftext___for_var_n0_n_string.length_n_var_cstring.charCodeAt_n__if_c_128_utftextString.fromCharCode_c_else_if__c_127__c_2048__utftextString.fromCharCode__c__6_192__utftextString.fromCharCode__c63_128_elseutftextString.fromCharCode__c__12_224__utftextString.fromCharCode___c__6_63_128__utftextString.fromCharCode__c63_128_return_utftext_var_xArray___var_k_AA_BB_CC_DD_a_b_c_d_var_S117_S1212_S1317_S1422_var_S215_S229_S2314_S2420_var_S314_S3211_S3316_S3423_var_S416_S4210_S4315_S4421_stringUtf8Encode_string__xConvertToWordArray_string__a0x67452301_b0xEFCDAB89_c0x98BADCFE_d0x10325476_for_k0_k_x.length_k16_AAa_BBb_CCc_DDd_aFF_a_b_c_d_x_k0__S11_0xD76AA478__dFF_d_a_b_c_x_k1__S12_0xE8C7B756__cFF_c_d_a_b_x_k2__S13_0x242070DB__bFF_b_c_d_a_x_k3__S14_0xC1BDCEEE__aFF_a_b_c_d_x_k4__S11_0xF57C0FAF__dFF_d_a_b_c_x_k5__S12_0x4787C62A__cFF_c_d_a_b_x_k6__S13_0xA8304613__bFF_b_c_d_a_x_k7__S14_0xFD469501__aFF_a_b_c_d_x_k8__S11_0x698098D8__dFF_d_a_b_c_x_k9__S12_0x8B44F7AF__cFF_c_d_a_b_x_k10__S13_0xFFFF5BB1__bFF_b_c_d_a_x_k11__S14_0x895CD7BE__aFF_a_b_c_d_x_k12__S11_0x6B901122__dFF_d_a_b_c_x_k13__S12_0xFD987193__cFF_c_d_a_b_x_k14__S13_0xA679438E__bFF_b_c_d_a_x_k15__S14_0x49B40821__aGG_a_b_c_d_x_k1__S21_0xF61E2562__dGG_d_a_b_c_x_k6__S22_0xC040B340__cGG_c_d_a_b_x_k11__S23_0x265E5A51__bGG_b_c_d_a_x_k0__S24_0xE9B6C7AA__aGG_a_b_c_d_x_k5__S21_0xD62F105D__dGG_d_a_b_c_x_k10__S22_0x2441453__cGG_c_d_a_b_x_k15__S23_0xD8A1E681__bGG_b_c_d_a_x_k4__S24_0xE7D3FBC8__aGG_a_b_c_d_x_k9__S21_0x21E1CDE6__dGG_d_a_b_c_x_k14__S22_0xC33707D6__cGG_c_d_a_b_x_k3__S23_0xF4D50D87__bGG_b_c_d_a_x_k8__S24_0x455A14ED__aGG_a_b_c_d_x_k1
push 0x8000
push ebx
mov dword [eax], 3
call fcn.10001f89
add esp, 0x10
lea eax, [ebx + 1]
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x100221e9
sub ebx, eax
mov eax, ebx
jmp 0x100226a6
cmp dword [0x1006ef44], 5
jl 0x1002220d
push str.Processing_Request
call fcn.1001fbc0
pop ecx
push 0x10058084
push edi
call fcn.1002cf70
pop ecx
pop ecx
test eax, eax
jne 0x10022226
mov dword [ebp - 0x1bd0], edi
jmp 0x1002222d
inc eax
mov dword [ebp - 0x1bd0], eax
push 0xc
push str._LocalUsers
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022261
mov ecx, dword [ebp - 0x1bd8]
xor edx, edx
call fcn.10028555
mov ecx, dword [ebp - 0x1bd8]
call fcn.10025510
or eax, 0xffffffff
jmp 0x100226a6
push 0xd
push str._DomainUsers
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002228f
mov ecx, dword [ebp - 0x1bd8]
xor edx, edx
call fcn.10028555
mov ecx, dword [ebp - 0x1bd8]
call fcn.10025ad6
jmp 0x10022259
push 0x13
push str._LocalGroupMembers
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100222bd
mov ecx, dword [ebp - 0x1bd8]
xor edx, edx
call fcn.10028555
mov ecx, dword [ebp - 0x1bd8]
call fcn.10026335
jmp 0x10022259
push 0x14
push str._DomainGroupMembers
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100222ee
mov ecx, dword [ebp - 0x1bd8]
xor edx, edx
call fcn.10028555
mov ecx, dword [ebp - 0x1bd8]
call fcn.100265f9
jmp 0x10022259
push 0xb
push str._Challenge
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002231f
mov ecx, dword [ebp - 0x1bd8]
xor edx, edx
call fcn.10028555
mov ecx, dword [ebp - 0x1bd8]
call fcn.100283c6
jmp 0x10022259
push 8
push str._RegDump
push edi
call fcn.1002ce60
add esp, 0xc
test eax, eax
jne 0x10022366
mov edx, dword [ebp - 0x1bd0]
lea eax, [ebp - 0xbec]
push ecx
mov ecx, dword [ebp - 0x1bd8]
push eax
call fcn.100287ee
pop ecx
pop ecx
lea ecx, [ebp - 0xbec]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022357
sub ecx, edx
je 0x10022259
push 9
push str._eventlog
push edi
call fcn.1002ce60
add esp, 0xc
xor ecx, ecx
inc ecx
test eax, eax
cmove esi, ecx
push 0xffffffffffffffff
push str._HTML__head__title_InterSect_Alliance___Information_Technology_Security__title__meta_name_TITLE__content_InterSect_Alliance___Information_Technology_Security___style_type_text_css___nbody__n_font_family:_Verdana_Helvetica_sans_serif__n_font_size:_10px__font_weight:_normal__n_margin:_0px__n_nh1__n_font_size:_30px__n_font_family:_Verdana_Helvetica_sans_serif__n_color:_white__n_nh2__n_font_size:_30px__n_font_family:_Verdana_Helvetica_sans_serif__n_color:_black__n_nfont__n_font_family:_Verdana_Helvetica_sans_serif__n_text_decoration:_none__font_size:_10px__n_font_weight:_normal__n_ntable__n_margin:_0px__padding:_0px__n_ntd__n_font_size:_75___n_n__style__n_meta_HTTP_EQUIV_Pragma__CONTENT_no_cache___n_meta_HTTP_EQUIV_Expires__CONTENT__1___n
push 0x8000
push ebx
call fcn.10001f89
add esp, 0x10
test esi, esi
mov esi, 0x8000
je 0x100223ad
push 0xffffffffffffffff
push str._meta_HTTP_EQUIV_Refresh__CONTENT_30___n
push esi
push ebx
call fcn.100014e3
add esp, 0x10
push 0xffffffffffffffff
push str._script_type_text_javascript__src__MD5.js____script__n_script_type_text_javascript___n________function_toggleVisible_visDiv___n____________visDiv.style.display__visDiv.style.display___block_____none__:__block___n_________n________function_toggleDisabledGroup_el___n____________try__n________________el.disabled__el.disabled___false_:_true__n________________if__el.type___checkbox____n_________________n_____________n____________catch_E__n____________if__el.childNodes__el.childNodes.length___0___n________________for__var_x__0__x___el.childNodes.length__x___n____________________toggleDisabledGroup_el.childNodes_x____n_________________n_____________n_________n__script__n__head__body_textblack_bgcolorwhite_link000066_vlink000044_alink000055__table_border0_cellspacing0_cellpadding0_columns3_width100___tbody__tr__td_height70__img_src_intersect.gif_alt_InterSect__width205_height70_hspace20_vspace0_border0_alignRight___td__td_height70_width1__bgcoloreeeeee__br___td__td_height70_width1__bgcolordddddd__br___td__td_height70_width1__bgcolorcccccc__br___td__td_height70_width1__bgcolorccbbbb__br___td__td_height70_width1__bgcolorccaaaa__br___td__td_height70_width1__bgcolorcc9999__br___td__td_height70_width1__bgcolorcc8888__br___td__td_height70_width1__bgcolorcc7777__br___td__td_height70_width1__bgcolorcc6666__br___td__td_height70_width1__bgcolorcc5555__br___td__td_height70_width1__bgcolorcc4444__br___td__td_height70_width1__bgcolorcc3333__br___td__td_height70_width1__bgcolorcc2222__br___td__td_height70_width1__bgcolorcc1111__br___td__td_height70_width86__bgcolorcc0000__div_alignright__center__h1_SNARE_for_Windows_Open_Sourcenbsp___h1___center___div___td___tr___tbody___table__table_border0_cellspacing0_cellpadding0_columns1_width100___tr__td_height3_border0_bgcolorwhite_width100____td___tr__tr__td_height3_border0_bgcolorblack_width100____td___tr__tr__td_height2_border0_bgcolorAAAAAA_width100____td___tr__tr__td_height2_border0_bgcolorwhite_width100____td___tr___table__table_border0_cellspacing0_cellpadding5_columns2_width100__height100___tbody__tr__td_valignTop_width20__bgcolorcc0000__div_alignCenter__font_colorffffff__br__font_face_Helvetica_Arial_sans_serif__size_1__B__br__A_HREF__eventlog__style_color:FFFFFF_text_decoration:none__Latest_Events__A__br__br__A_HREF__network__style_color:FFFFFF_text_decoration:none__Network_Configuration__A__br__br__A_HREF__remote__style_color:FFFFFF_text_decoration:none__Remote_Control_Configuration__A__br__br__A_HREF__objective__style_color:FFFFFF_text_decoration:none__Objectives_Configuration__A__br__br__A_HREF__status__style_color:FFFFFF_text_decoration:none__HeartBeat_and_Agent_Log__A__br__br__A_HREF__status__style_color:FFFFFF_text_decoration:none__View_Audit_Service_Status__A__br__br__A_HREF__restart__style_color:FFFFFF_text_decoration:none__Apply_the_Latest_Audit_Configuration__A__br___div__br__font_size_2__A_HREF__LocalUsers__style_color:FFFFFF_text_decoration:none__target_SnareData__Local_Users__A___font__br__font_size_2__A_HREF__DomainUsers__style_color:FFFFFF_text_decoration:none__target_SnareData__Domain_Users__A___font__br__font_size_2__A_HREF__LocalGroupMembers__style_color:FFFFFF_text_decoration:none__target_SnareData__Local_Group_Members__A___font__br__font_size_2__A_HREF__DomainGroupMembers__style_color:FFFFFF_text_decoration:none__target_SnareData__Domain_Group_Members__A___font__br__font_size_2__A_HREF__RegDump__style_color:FFFFFF_text_decoration:none__target_SnareData__Registry_Dump__A___font__br___b___font__br___td__td_width100__valignTop__table_cellpadding0_cellspacing10_border0_width100___tbody__tr__td_valignTop_alignJustify_
push esi
push ebx
call fcn.100014e3
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100223c3
sub ecx, edx
push 0
pop eax
sub esi, ecx
mov dword [ebp - 0x1bd0], ecx
push 9
cmovs esi, eax
mov eax, dword [ebp - 0x1bd4]
push str._network
push edi
mov dword [eax], 1
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022416
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.10022751
mov dword [ebp - 0x1bd0], eax
mov esi, eax
jmp 0x10022613
push 8
push str._remote
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002243b
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.100231d1
jmp 0x10022409
push 0xb
push str._setremote
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022466
mov edx, dword [ebp - 0x1bd0]
mov ecx, dword [ebp - 0x1bdc]
push esi
lea edx, [ebx + edx]
call fcn.1002339e
jmp 0x10022409
push 0xb
push str._objective
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002248e
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.10023844
jmp 0x10022409
push 0xe
push str._setobjective
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100224bc
mov edx, dword [ebp - 0x1bd0]
mov ecx, dword [ebp - 0x1bdc]
push esi
lea edx, [ebx + edx]
call fcn.10023ec9
jmp 0x10022409
push 0x11
push str._setobjectiveval
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100224ea
mov edx, dword [ebp - 0x1bd0]
mov ecx, dword [ebp - 0x1bdc]
push esi
lea edx, [ebx + edx]
call fcn.10024a3e
jmp 0x10022409
push 9
push str._restart
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022512
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.10025326
jmp 0x10022409
push 0xc
push str._setrestart
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022547
mov edx, dword [ebp - 0x1bd0]
push dword [ebp - 0x1be0]
mov ecx, dword [ebp - 0x1bdc]
push esi
lea edx, [ebx + edx]
call fcn.100253ec
pop ecx
jmp 0x10022409
push 0xc
push str._setnetwork
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x10022575
mov edx, dword [ebp - 0x1bd0]
mov ecx, dword [ebp - 0x1bdc]
push esi
lea edx, [ebx + edx]
call fcn.10022b79
jmp 0x10022409
push 8
push str._status
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x1002259d
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.100226b7
jmp 0x10022409
push 0xa
push str._eventlog
push edi
call fcn.10013480
add esp, 0xc
test eax, eax
jne 0x100225c2
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.10028f96
jmp 0x10022611
lea ecx, [ebp - 0xbec]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100225cb
sub ecx, edx
je 0x100225f5
mov edx, dword [ebp - 0x1bd0]
lea eax, [ebp - 0xbec]
push 0xffffffffffffffff
push eax
add edx, ebx
push esi
push edx
call fcn.10001f89
add esp, 0x10
xor esi, esi
jmp 0x10022614
cmp byte [edi], 0x2f
jne 0x10022648
movzx eax, byte [edi + 1]
test al, al
jne 0x10022648
mov edx, dword [ebp - 0x1bd0]
push esi
lea edx, [ebx + edx]
call fcn.100226b7
mov esi, eax
pop ecx
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022619
sub ecx, edx
mov edx, 0x8000
push 0
sub edx, ecx
lea eax, [ebx + ecx]
pop ecx
push 0xffffffffffffffff
cmovs edx, ecx
push str.__td___tr___tbody___table___body__center__BR__BR__FONT_SIZE_1_facehelvetica__c___A_HREF_http:__www.intersectalliance.com__Intersect_Alliance__A__Pty_Ltd_1999_2013._This_site_is_powered_by__A_HREF_http:__www.intersectalliance.com_projects___SNARE_for_Windows.__A___FONT___td___tr___tbody___table___center___html_
push edx
push eax
call fcn.10001f89
add esp, 0x10
jmp 0x10022038
cmp dword [0x1006ef44], 5
jl 0x1002265c
push str.No_page___sending_a_404
call fcn.1001fbc0
pop ecx
push 0xffffffffffffffff
push str.HTTP_1.0_404_Not_Found_r_nServer:_SNARE_1.0_r_nMIME_version:_1.0_r_nContent_type:_text_html_r_n_r_n_html__body__center__h2_Page_Not_Found__h2___center___body___html_
lea eax, [ebp - 0x20c]
push 0x200
push eax
call fcn.10001f89
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022680
push 0
sub ecx, edx
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x1bd8]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x10022259
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000adad
mov esp, ebp
pop ebp
ret