Function at 0x1005f360
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using xor
Get socket status
Hash data with md5
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098db9
mov eax, dword fs:[0]
push eax
sub esp, 0x5b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x558], esi
mov eax, dword [ebp + 8]
push 0
push 1
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x580], 1
mov dword [ebp - 0x5bc], 0xb4
mov dword [ebp - 0x5b8], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x12c], eax
cmp eax, 0xffffffff
jne 0x1005f3ff
push 0x100c97d8
lea eax, [ebp - 0x5ac]
mov dword [ebp - 0x5ac], 0x6a
push eax
call fcn.100823fd
mov eax, dword [ebp + 0xc]
test ax, ax
je 0x1005f415
mov edi, dword [sym.imp.WS2_32.dll_htons]
push eax
call edi
movzx eax, ax
jmp 0x1005f439
push 0
push str.mail
call dword [sym.imp.WS2_32.dll_getservbyname]
mov edi, dword [sym.imp.WS2_32.dll_htons]
test eax, eax
jne 0x1005f435
push 0x19
call edi
movzx eax, ax
jmp 0x1005f439
movzx eax, word [eax + 8]
push eax
mov dword [ebp - 0x560], eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xorps xmm0, xmm0
mov dword [ebp - 0x550], eax
mov eax, 2
movdqu xmmword [ebp - 0x2c4], xmm0
mov word [ebp - 0x2c4], ax
movzx eax, word [esi + 0x138]
test ax, ax
jne 0x1005f4c9
mov eax, dword [ebp - 0x560]
mov edi, dword [ebp - 0x554]
push edi
mov word [ebp - 0x2c2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x2c0], eax
cmp eax, 0xffffffff
jne 0x1005f513
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1005f4fa
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x574]
mov dword [ebp - 0x574], 0x69
push eax
call fcn.100823fd
push eax
call edi
push dword [esi + 0x134]
mov word [ebp - 0x2c2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x2c0], eax
cmp eax, 0xffffffff
jne 0x1005f513
push dword [esi + 0x134]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1005f557
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x2c0]
push eax
call fcn.100865f0
add esp, 0xc
lea eax, [ebp - 0x580]
push eax
push 0x8004667e
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1005f57e
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x5a8]
mov dword [ebp - 0x5a8], 0x6c
push eax
call fcn.100823fd
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x598]
mov dword [ebp - 0x598], 0x69
push eax
call fcn.100823fd
push 0x10
lea eax, [ebp - 0x2c4]
push eax
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1005fb96
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1005f5d0
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x588]
mov dword [ebp - 0x588], 0x68
push eax
call fcn.100823fd
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
jmp 0x1005f5e0
mov eax, dword [esi + 0x12c]
lea ecx, [ebp - 0x5bc]
push ecx
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x548], eax
push ecx
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x444], eax
push ecx
push 0
inc eax
mov dword [ebp - 0x54c], 1
push eax
mov dword [ebp - 0x448], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x1005f651
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x5a0]
mov dword [ebp - 0x5a0], 0x6d
push eax
call fcn.100823fd
test eax, eax
jne 0x1005f67c
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x193
push eax
call fcn.100823fd
lea eax, [ebp - 0x54c]
push eax
push dword [esi + 0x12c]
call edi
test eax, eax
je 0x1006152c
cmp word [esi + 0x138], 0
je 0x1005f6e2
push dword [ebp - 0x550]
mov edx, dword [ebp - 0x554]
mov ecx, dword [esi + 0x12c]
call fcn.1005f1b0
add esp, 4
test eax, eax
jne 0x1005f6e2
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x56c], 0x69
push eax
call fcn.100823fd
mov edx, dword [ebp - 0x54c]
xor ecx, ecx
test edx, edx
je 0x1005f733
mov eax, dword [esi + 0x12c]
cmp dword [ebp + ecx*4 - 0x548], eax
je 0x1005f704
inc ecx
cmp ecx, edx
jb 0x1005f6f4
jmp 0x1005f733
lea eax, [edx - 1]
cmp ecx, eax
jae 0x1005f72c
jmp 0x1005f710
mov eax, dword [ebp + ecx*4 - 0x544]
mov dword [ebp + ecx*4 - 0x548], eax
inc ecx
mov edx, dword [ebp - 0x54c]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1005f710
dec edx
mov dword [ebp - 0x54c], edx
mov edx, dword [ebp - 0x448]
xor ecx, ecx
test edx, edx
je 0x1005f783
mov eax, dword [esi + 0x12c]
cmp dword [ebp + ecx*4 - 0x444], eax
je 0x1005f755
inc ecx
cmp ecx, edx
jb 0x1005f745
jmp 0x1005f783
lea eax, [edx - 1]
cmp ecx, eax
jae 0x1005f77c
lea esp, [esp]
mov eax, dword [ebp + ecx*4 - 0x440]
mov dword [ebp + ecx*4 - 0x444], eax
inc ecx
mov edx, dword [ebp - 0x448]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1005f760
dec edx
mov dword [ebp - 0x448], edx
mov eax, dword [ebp + 0x10]
cmp eax, 3
je 0x1005f791
mov dword [esi + 0x168], eax
mov eax, dword [esi + 0x168]
cmp eax, 1
je 0x1005f7a1
cmp eax, 2
jne 0x1005f7ee
call fcn.10002820
call fcn.10003390
call fcn.10003380
push eax
call fcn.100023a0
add esp, 4
mov dword [esi + 0x16c], eax
test eax, eax
jne 0x1005f7de
push 0x100c97d8
lea eax, [ebp - 0x570]
mov dword [ebp - 0x570], 0x19e
push eax
call fcn.100823fd
cmp dword [esi + 0x168], 2
jne 0x1005f7ee
mov ecx, esi
call fcn.10063010
xor edx, edx
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], edx
je 0x1005f809
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005f7f4
jmp 0x1005f813
lea eax, [ecx + ecx*4]
lea edx, [eax*4 + 0x100db750]
push edx
mov ecx, esi
call fcn.10062b70
mov ecx, esi
call fcn.100626f0
cmp dword [esi + 0x168], 1
jne 0x1005f839
mov ecx, esi
call fcn.100627f0
mov ecx, esi
call fcn.100626f0
cmp byte [ebp + 0x14], 0
je 0x1005fb96
mov ecx, dword [esi + 0x128]
mov edx, str.AUTH
call fcn.1005d4a0
cmp al, 1
jne 0x1005fb96
xor edi, edi
je 0x1005f886
cmp byte [edi], 0
jne 0x1005f868
xor ecx, ecx
jmp 0x1005f879
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f870
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0xd4]
call fcn.100638e0
cmp dword [esi + 0xe4], edi
jne 0x1005f8a9
push 0x100c97d8
lea eax, [ebp - 0x57c]
mov dword [ebp - 0x57c], 0xcc
push eax
call fcn.100823fd
xor edi, edi
je 0x1005f8d6
cmp byte [edi], 0
jne 0x1005f8b6
xor ecx, ecx
jmp 0x1005f8c9
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x1005f8c0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f8c0
sub ecx, edx
push ecx
push edi
lea ecx, [esi + 0xec]
call fcn.100638e0
cmp dword [esi + 0xfc], edi
jne 0x1005f8f9
push 0x100c97d8
lea eax, [ebp - 0x584]
mov dword [ebp - 0x584], 0xcd
push eax
call fcn.100823fd
mov ecx, dword [esi + 0x128]
mov edx, str.LOGIN
call fcn.1005d4a0
cmp al, 1
jne 0x1005fbbb
xor edi, edi
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], 3
je 0x1005f92d
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005f917
jmp 0x1005f937
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_LOGIN_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [esi + 0xe8], 0x10
lea ecx, [esi + 0xd4]
jb 0x1005f970
mov ecx, dword [ecx]
mov edx, dword [esi + 0xe4]
lea eax, [ebp - 0x19c]
push 0x100
push eax
call fcn.1005ce50
add esp, 8
cmp eax, 0x100
jae 0x1005fbb6
mov byte [ebp + eax - 0x19c], 0
cmp byte [ebp - 0x19c], 0
mov dword [ebp - 0x200], 0xf
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
jne 0x1005f9c5
xor ecx, ecx
jmp 0x1005f9d9
lea ecx, [ebp - 0x19c]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005f9d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x214]
call fcn.100638e0
xor edi, edi
mov byte [ebp - 4], 1
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100db750], 7
je 0x1005fa0c
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005f9f6
jmp 0x1005fa16
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
cmp dword [ebp - 0x200], 0x10
lea eax, [ebp - 0x214]
cmovae eax, dword [ebp - 0x214]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x10
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
jb 0x1005fa64
mov ecx, dword [ecx]
mov edx, dword [esi + 0xfc]
lea eax, [ebp - 0x19c]
push 0x100
push eax
call fcn.1005ce50
add esp, 8
cmp eax, 0x100
jae 0x1005fbb6
mov byte [ebp + eax - 0x19c], 0
cmp byte [ebp - 0x19c], 0
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jne 0x1005fab9
xor ecx, ecx
jmp 0x1005facb
lea ecx, [ebp - 0x19c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fac2
sub ecx, edx
push ecx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
xor edi, edi
mov byte [ebp - 4], 2
xor ecx, ecx
xor eax, eax
jmp 0x1005faf0
cmp dword [eax + 0x100db750], 8
je 0x1005fb06
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005faf0
jmp 0x1005fb10
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
cmp dword [ebp - 0x1a0], 0x10
lea eax, [ebp - 0x1b4]
cmovae eax, dword [ebp - 0x1b4]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x10
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x1a0], 0x10
jb 0x1005fb64
push dword [ebp - 0x1b4]
call fcn.1007b9e6
add esp, 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jb 0x1005fb96
push dword [ebp - 0x214]
call fcn.1007b9e6
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret 0x18
call fcn.1007bb23
mov ecx, dword [esi + 0x128]
mov edx, str.PLAIN
call fcn.1005d4a0
cmp al, 1
jne 0x1005fd0d
xor ecx, ecx
mov dword [ebp - 0x554], edi
xor eax, eax
lea ecx, [ecx]
cmp dword [eax + 0x100db750], 2
je 0x1005fbf6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fbe0
jmp 0x1005fc06
lea eax, [ecx + ecx*4]
lea eax, [eax*4 + 0x100db750]
mov dword [ebp - 0x554], eax
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
jb 0x1005fc17
mov ecx, dword [ecx]
cmp dword [esi + 0xe8], 0x10
lea eax, [esi + 0xd4]
jb 0x1005fc2a
mov edx, dword [eax]
jmp 0x1005fc2c
mov edx, eax
cmp dword [eax + 0x14], 0x10
jb 0x1005fc34
mov eax, dword [eax]
push ecx
push edx
push eax
push str._s_s_s
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
mov ecx, dword [esi + 0x124]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fc58
sub ecx, edx
mov edx, edi
mov dword [ebp - 0x55c], ecx
je 0x1005fc85
jmp 0x1005fc70
mov eax, dword [esi + 0x124]
cmp byte [edx + eax], 0x5e
jne 0x1005fc80
mov byte [edx + eax], 0
inc edx
cmp edx, ecx
jb 0x1005fc70
add ecx, 2
mov eax, 0x55555556
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edx, dword [ebp - 0x55c]
mov ecx, dword [esi + 0x124]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
push edi
push str.AUTH_PLAIN__s_r_n
push 0x2800
mov byte [edi + eax], 0
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x18
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp - 0x554]
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
jmp 0x1005fb96
mov ecx, dword [esi + 0x128]
mov edx, str.CRAM_MD5
call fcn.1005d4a0
cmp al, 1
jne 0x100604da
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x1005fd30
cmp dword [eax + 0x100db750], 4
je 0x1005fd46
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x1005fd30
jmp 0x1005fd50
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_CRAM_MD5_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
mov edx, dword [esi + 0x128]
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
cmp byte [edx], 0
jne 0x1005fda2
xor ecx, ecx
jmp 0x1005fdb0
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005fda7
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x22c]
call fcn.100638e0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x22c]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x22c]
cmp eax, edi
je 0x1005fe69
cmp dword [ebp - 0x218], 0x10
jb 0x1005fdfe
push dword [ebp - 0x22c]
call fcn.1007b9e6
add esp, 4
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
cmp dword [edi + 0x14], 0x10
jae 0x1005fe38
mov eax, dword [edi + 0x10]
inc eax
je 0x1005fe46
push eax
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.1007ac70
add esp, 0xc
jmp 0x1005fe46
mov eax, dword [edi]
mov dword [ebp - 0x22c], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x21c], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x218], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1a0], 0x10
jb 0x1005fe80
push dword [ebp - 0x1b4]
call fcn.1007b9e6
add esp, 4
mov eax, dword [ebp - 0x21c]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
inc eax
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x22c]
mov edx, dword [ebp - 0x21c]
cmovae ecx, dword [ebp - 0x22c]
push ecx
push eax
mov dword [ebp - 0x554], eax
call fcn.1005cf20
mov edx, dword [ebp - 0x554]
add esp, 8
mov byte [edx + eax], 0
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
cmp byte [edx], 0
jne 0x1005fefd
xor ecx, ecx
jmp 0x1005ff15
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x550], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ff08
sub ecx, dword [ebp - 0x550]
push ecx
push edx
lea ecx, [ebp - 0x1e4]
call fcn.100638e0
mov eax, dword [ebp - 0x554]
push eax
push 0
mov byte [ebp - 4], 4
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi + 0xfc]
mov dword [ebp - 0x558], eax
cmp eax, 0x40
jle 0x1005ffdb
push 0x11
push 0
call edi
push eax
mov eax, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
call eax
cmp dword [esi + 0x100], 0x10
lea edx, [esi + 0xec]
mov edi, eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
jb 0x1005ffaa
mov edx, dword [edx]
push dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
add esp, 4
lea ecx, [ebp - 0x2b4]
mov edx, edi
call fcn.10076390
mov byte [edi + 0x10], 0
mov dword [ebp - 0x558], 0x10
jmp 0x1006000e
inc eax
push eax
push 0
call edi
push eax
mov eax, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
call eax
cmp dword [esi + 0x100], 0x10
lea ecx, [esi + 0xec]
mov edi, eax
jb 0x1005fffc
mov ecx, dword [ecx]
mov edx, edi
mov edi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x10060000
push 0x40
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.10081800
push 0x40
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.10081800
push dword [ebp - 0x558]
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.100865f0
push dword [ebp - 0x558]
lea eax, [ebp - 0x308]
push edi
push eax
call fcn.100865f0
movdqa xmm1, xmmword [str.6666666666666666H]
add esp, 0x30
movdqa xmm2, xmmword [0x100c7220]
xor eax, eax
lea esp, [esp]
movdqu xmm0, xmmword [ebp + eax - 0x9c]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x9c], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x308]
pxor xmm0, xmm2
movdqu xmmword [ebp + eax - 0x308], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x8c]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x8c], xmm0
movdqu xmm0, xmmword [ebp + eax - 0x2f8]
pxor xmm0, xmm2
movdqu xmmword [ebp + eax - 0x2f8], xmm0
add eax, 0x20
cmp eax, 0x40
jl 0x10060070
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x11
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push 0x40
lea edx, [ebp - 0x9c]
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.100762d0
cmp dword [ebp - 0x1d0], 0x10
lea edx, [ebp - 0x1e4]
push dword [ebp - 0x1d4]
cmovae edx, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
mov edx, dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
call fcn.10076390
mov eax, dword [ebp - 0x558]
lea edx, [ebp - 0x308]
push 0x40
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov byte [eax + 0x10], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.100762d0
mov edx, dword [ebp - 0x558]
lea ecx, [ebp - 0x2b4]
push 0x10
call fcn.100762d0
add esp, 0x10
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x2b4]
call fcn.10076390
xor eax, eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x564], ecx
jmp 0x10060200
movzx eax, byte [ebp + eax - 0x4c]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x554]
add esp, 0xc
mov ecx, dword [ebp - 0x564]
inc eax
add ecx, 2
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x564], ecx
cmp eax, 0x10
jl 0x10060200
cmp byte [ebp - 0x38], 0
jne 0x10060240
xor ecx, ecx
jmp 0x1006024f
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060246
sub ecx, edx
push ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.100638e0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [ebp - 0x558]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push ecx
lea edx, [esi + 0xd4]
lea ecx, [ebp - 0x214]
call fcn.10064290
add esp, 4
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x1b4]
call fcn.10064350
mov edi, eax
add esp, 4
lea eax, [ebp - 0x1e4]
cmp eax, edi
je 0x10060344
cmp dword [ebp - 0x1d0], 0x10
jb 0x100602d9
push dword [ebp - 0x1e4]
call fcn.1007b9e6
add esp, 4
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
cmp dword [edi + 0x14], 0x10
jae 0x10060313
mov eax, dword [edi + 0x10]
inc eax
je 0x10060321
push eax
lea eax, [ebp - 0x1e4]
push edi
push eax
call fcn.1007ac70
add esp, 0xc
jmp 0x10060321
mov eax, dword [edi]
mov dword [ebp - 0x1e4], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1d4], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x1d0], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1a0], 0x10
jb 0x1006035b
push dword [ebp - 0x1b4]
call fcn.1007b9e6
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
jb 0x10060391
push dword [ebp - 0x214]
call fcn.1007b9e6
add esp, 4
mov ecx, dword [ebp - 0x1d4]
mov eax, 0x55555556
lea ecx, [ecx + 2]
imul ecx
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
cmp dword [ebp - 0x1d0], 0x10
lea ecx, [ebp - 0x1e4]
mov edx, dword [ebp - 0x1d4]
cmovae ecx, dword [ebp - 0x1e4]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
add esp, 8
mov byte [edi + eax], 0
cmp byte [edi], 0
jne 0x100603f6
xor ecx, ecx
jmp 0x10060409
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x10060400
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060400
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x22c]
call fcn.100638e0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp dword [ebp - 0x218], 0x10
lea eax, [ebp - 0x22c]
cmovae eax, dword [ebp - 0x22c]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x10
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 8
je 0x10060476
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x10060460
jmp 0x10060480
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x1d0], 0x10
jb 0x100604a7
push dword [ebp - 0x1e4]
call fcn.1007b9e6
add esp, 4
cmp dword [ebp - 0x218], 0x10
mov dword [ebp - 0x1d0], 0xf
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 0x1e4], 0
jb 0x1005fb96
push dword [ebp - 0x22c]
jmp 0x1005fb8e
mov ecx, dword [esi + 0x128]
mov edx, str.DIGEST_MD5
call fcn.1005d4a0
cmp al, 1
jne 0x10061503
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x10060500
cmp dword [eax + 0x100db750], 6
je 0x10060516
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x10060500
jmp 0x10060520
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push str.AUTH_DIGEST_MD5_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0xc
mov ecx, esi
push edi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
mov edx, dword [esi + 0x128]
mov dword [ebp - 0x230], 0xf
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x244], 0
cmp byte [edx], 0
jne 0x10060572
xor ecx, ecx
jmp 0x10060580
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060577
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x244]
call fcn.100638e0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x244]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x244]
cmp eax, edi
je 0x10060636
cmp dword [ebp - 0x230], 0x10
jb 0x100605cb
push dword [ebp - 0x244]
call fcn.1007b9e6
add esp, 4
mov dword [ebp - 0x230], 0xf
mov dword [ebp - 0x234], 0
mov byte [ebp - 0x244], 0
cmp dword [edi + 0x14], 0x10
jae 0x10060605
mov eax, dword [edi + 0x10]
inc eax
je 0x10060613
push eax
lea eax, [ebp - 0x244]
push edi
push eax
call fcn.1007ac70
add esp, 0xc
jmp 0x10060613
mov eax, dword [edi]
mov dword [ebp - 0x244], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x234], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x230], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060647
push dword [ebp - 0x30]
call fcn.1007b9e6
add esp, 4
mov eax, dword [ebp - 0x234]
cdq
and edx, 3
add eax, edx
sar eax, 2
lea eax, [eax + eax*2]
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
cmp dword [ebp - 0x230], 0x10
lea ecx, [ebp - 0x244]
mov edx, dword [ebp - 0x234]
mov edi, eax
cmovae ecx, dword [ebp - 0x244]
push ecx
push edi
call fcn.1005cf20
add esp, 8
mov byte [edi + eax], 0
mov dword [ebp - 0x1a0], 0xf
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x1b4], 0
cmp byte [edi], 0
jne 0x100606b8
xor ecx, ecx
jmp 0x100606c9
mov ecx, edi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100606c0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
push edi
push 0
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 5
push ecx
push str.nonce
lea ecx, [ebp - 0x1b4]
call fcn.100637f0
test eax, eax
jns 0x1006071c
push 0x100c97d8
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x58c], 0xcf
push eax
call fcn.100823fd
push 0xffffffffffffffff
add eax, 7
lea ecx, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.10063250
push 1
push ecx
push 0x100c5dcc
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 8
call fcn.100637f0
test eax, eax
jns 0x1006076a
push 0x100c97d8
lea eax, [ebp - 0x594]
mov dword [ebp - 0x594], 0xcf
push eax
call fcn.100823fd
push eax
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1fc]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1fc]
cmp eax, edi
je 0x1006080e
cmp dword [ebp - 0x1e8], 0x10
jb 0x100607a3
push dword [ebp - 0x1fc]
call fcn.1007b9e6
add esp, 4
mov dword [ebp - 0x1e8], 0xf
mov dword [ebp - 0x1ec], 0
mov byte [ebp - 0x1fc], 0
cmp dword [edi + 0x14], 0x10
jae 0x100607dd
mov eax, dword [edi + 0x10]
inc eax
je 0x100607eb
push eax
lea eax, [ebp - 0x1fc]
push edi
push eax
call fcn.1007ac70
add esp, 0xc
jmp 0x100607eb
mov eax, dword [edi]
mov dword [ebp - 0x1fc], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1ec], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x1e8], eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp dword [ebp - 0x1c], 0x10
jb 0x1006081f
push dword [ebp - 0x30]
call fcn.1007b9e6
add esp, 4
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
push 5
push ecx
push str.realm
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 9
call fcn.100637f0
test eax, eax
js 0x10060968
push 0xffffffffffffffff
add eax, 7
lea ecx, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1cc]
cmp eax, edi
je 0x100608b8
cmp dword [ebp - 0x1b8], 0x10
jb 0x10060891
push dword [ebp - 0x1cc]
call fcn.1007b9e6
add esp, 4
push edi
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x100608c9
push dword [ebp - 0x30]
call fcn.1007b9e6
add esp, 4
push 1
push ecx
push 0x100c5dcc
lea ecx, [ebp - 0x1cc]
call fcn.100637f0
test eax, eax
jns 0x100608fb
push 0x100c97d8
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0xcf
push eax
call fcn.100823fd
push eax
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.10063250
mov edi, eax
lea eax, [ebp - 0x1cc]
cmp eax, edi
je 0x10060957
cmp dword [ebp - 0x1b8], 0x10
jb 0x10060930
push dword [ebp - 0x1cc]
call fcn.1007b9e6
add esp, 4
push edi
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060968
push dword [ebp - 0x30]
call fcn.1007b9e6
add esp, 4
push 0
call fcn.1007bee9
push eax
push 0x100c5dd8
lea eax, [ebp - 0x4c]
push 0x11
push eax
call fcn.1007ac47
push 1
push str._08d
lea eax, [ebp - 0x58]
push 9
push eax
call fcn.1007ac47
add esp, 0x24
mov dword [ebp - 0x200], 0xf
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
push 4
push str.auth
call fcn.100638e0
lea eax, [ebp - 0x5a4]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x344]
mov dword [ebp - 0x5a4], 0x80
push eax
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x10060a09
push 0x100c97d8
lea eax, [ebp - 0x568]
mov dword [ebp - 0x568], 0xd0
push eax
call fcn.100823fd
push dword [ebp - 0x340]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
cmp byte [edx], 0
jne 0x10060a3b
xor ecx, ecx
jmp 0x10060a49
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060a40
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x25c]
call fcn.100638e0
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x30]
call fcn.100643d0
mov edi, eax
add esp, 4
lea eax, [ebp - 0x25c]
cmp eax, edi
je 0x10060ab6
cmp dword [ebp - 0x248], 0x10
jb 0x10060a8f
push dword [ebp - 0x25c]
call fcn.1007b9e6
add esp, 4
push edi
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
call fcn.100634b0
cmp dword [ebp - 0x1c], 0x10
jb 0x10060ac7
push dword [ebp - 0x30]
call fcn.1007b9e6
add esp, 4
push 0x11
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
cmp dword [esi + 0xe8], 0x10
lea edi, [esi + 0xd4]
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
jb 0x10060b2d
mov edx, dword [edi]
jmp 0x10060b2f
mov edx, edi
push dword [esi + 0xe4]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
cmp dword [ebp - 0x1b8], 0x10
lea edx, [ebp - 0x1cc]
push dword [ebp - 0x1bc]
cmovae edx, dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
lea edx, [esi + 0xec]
add esp, 0x10
cmp dword [edx + 0x14], 0x10
jb 0x10060b9a
mov edx, dword [edx]
push dword [esi + 0xfc]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
mov edx, dword [ebp - 0x560]
lea ecx, [ebp - 0x2b4]
add esp, 4
call fcn.10076390
mov eax, dword [ebp - 0x560]
push 0x21
push 0
mov byte [eax + 0x10], 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edx, dword [ebp - 0x560]
lea ecx, [ebp - 0x2b4]
push 0x10
mov dword [ebp - 0x564], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
cmp dword [ebp - 0x1e8], 0x10
lea edx, [ebp - 0x1fc]
push dword [ebp - 0x1ec]
cmovae edx, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
lea ecx, [ebp - 0x4c]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060c81
sub ecx, edx
lea edx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
add esp, 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.10076390
mov ecx, dword [ebp - 0x564]
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x55c], ecx
mov edi, edi
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x554]
add esp, 0xc
mov ecx, dword [ebp - 0x55c]
inc eax
add ecx, 2
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x55c], ecx
cmp eax, 0x10
jl 0x10060cc0
push 0x21
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push 0xd
mov edx, str.AUTHENTICATE:
mov dword [ebp - 0x554], eax
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.100762d0
cmp dword [ebp - 0x248], 0x10
lea edx, [ebp - 0x25c]
push dword [ebp - 0x24c]
cmovae edx, dword [ebp - 0x25c]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
add esp, 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.10076390
mov ecx, dword [ebp - 0x554]
xor eax, eax
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x550], ecx
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x55c]
add esp, 0xc
mov ecx, dword [ebp - 0x550]
inc eax
add ecx, 2
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x550], ecx
cmp eax, 0x10
jl 0x10060da5
push dword [ebp - 0x560]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edx, dword [ebp - 0x564]
lea ecx, [ebp - 0x2b4]
push 0x20
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0x67452301
mov dword [ebp - 0x2a8], 0xefcdab89
mov dword [ebp - 0x2a4], 0x98badcfe
mov dword [ebp - 0x2a0], 0x10325476
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
cmp dword [ebp - 0x1e8], 0x10
lea edx, [ebp - 0x1fc]
push dword [ebp - 0x1ec]
cmovae edx, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
lea ecx, [ebp - 0x58]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060e91
sub ecx, edx
lea edx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
lea ecx, [ebp - 0x4c]
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060ec4
sub ecx, edx
lea edx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
cmp dword [ebp - 0x200], 0x10
lea edx, [ebp - 0x214]
push dword [ebp - 0x204]
cmovae edx, dword [ebp - 0x214]
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
push 1
mov edx, 0x100c5df4
lea ecx, [ebp - 0x2b4]
call fcn.100762d0
mov edx, dword [ebp - 0x554]
lea ecx, [ebp - 0x2b4]
push 0x20
call fcn.100762d0
add esp, 0x14
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.10076390
xor eax, eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x55c], ecx
lea ebx, [ebx]
movzx eax, byte [ebp + eax - 0x28]
push eax
push 0x100c5b98
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x550]
add esp, 0xc
mov ecx, dword [ebp - 0x55c]
inc eax
add ecx, 2
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x55c], ecx
cmp eax, 0x10
jl 0x10060f60
cmp byte [ebp - 0x7c], 0
jne 0x10060fa0
xor ecx, ecx
jmp 0x10060faf
lea ecx, [ebp - 0x7c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10060fa6
sub ecx, edx
push ecx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.100638e0
push dword [ebp - 0x564]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [ebp - 0x554]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push str.charset
push dword [esi + 0x128]
call fcn.1007b2c0
add esp, 8
cmp dword [edi + 0x14], 0x10
jb 0x10061004
mov edi, dword [edi]
push edi
push str.charsetutf_8_username__s_
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x10
cmp dword [ebp - 0x1bc], 0
je 0x10061093
cmp dword [ebp - 0x1b8], 0x10
lea eax, [ebp - 0x1cc]
cmovae eax, dword [ebp - 0x1cc]
push eax
push str._realm__s_
push 0x2800
push dword [esi + 0x128]
call fcn.1007ac47
mov edx, dword [esi + 0x128]
add esp, 0x10
mov ecx, edx
mov dword [ebp - 0x550], ecx
mov al, byte [edx]
inc edx
test al, al
jne 0x10061061
mov edi, dword [esi + 0x124]
sub edx, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10061071
mov esi, dword [ebp - 0x550]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x558]
cmp dword [ebp - 0x1e8], 0x10
lea eax, [ebp - 0x1fc]
cmovae eax, dword [ebp - 0x1fc]
push eax
push str._nonce__s_
push 0x2800
push dword [esi + 0x128]
call fcn.1007ac47
mov edx, dword [esi + 0x128]
add esp, 0x10
mov ecx, edx
mov dword [ebp - 0x550], ecx
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x100610d0
mov edi, dword [esi + 0x124]
sub edx, ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100610e0
mov esi, dword [ebp - 0x550]
lea eax, [ebp - 0x58]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov eax, dword [ebp - 0x558]
mov ecx, edx
push str._nc_s
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x2800
push dword [eax + 0x128]
call fcn.1007ac47
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
lea esp, [esp]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061130
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061140
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x4c]
push ecx
push str._cnonce__s_
push 0x2800
push dword [eax + 0x128]
call fcn.1007ac47
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061180
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061190
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x248], 0x10
lea ecx, [ebp - 0x25c]
cmovae ecx, dword [ebp - 0x25c]
push ecx
push str._digest_uri__s_
push 0x2800
push dword [eax + 0x128]
call fcn.1007ac47
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100611e1
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100611f1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x1a0], 0x10
lea ecx, [ebp - 0x1b4]
cmovae ecx, dword [ebp - 0x1b4]
push ecx
push str._response_s
push 0x2800
push dword [eax + 0x128]
call fcn.1007ac47
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10061242
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10061252
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x200], 0x10
lea ecx, [ebp - 0x214]
cmovae ecx, dword [ebp - 0x214]
push ecx
push str._qop_s
push 0x2800
push dword [eax + 0x128]
call fcn.1007ac47
mov eax, dword [ebp - 0x558]
add esp, 0x10
mov edx, dword [eax + 0x128]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100612a3
mov edi, dword [eax + 0x124]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100612b3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x558]
mov ecx, dword [esi + 0x124]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100612d8
sub ecx, edx
mov eax, 0x55555556
mov dword [ebp - 0x55c], ecx
add ecx, 2
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
shl edi, 2
inc edi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edx, dword [ebp - 0x55c]
mov ecx, dword [esi + 0x124]
push edi
mov edi, eax
mov dword [ebp - 0x550], eax
push edi
call fcn.1005ce50
add esp, 8
mov byte [edi + eax], 0
cmp byte [edi], 0
jne 0x10061337
xor ecx, ecx
jmp 0x10061349
mov ecx, edi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10061340
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x244]
call fcn.100638e0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
cmp dword [ebp - 0x230], 0x10
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0x10
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x100db750], 6
je 0x100613b6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x100613a0
jmp 0x100613c0
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
push 0x100c5bac
push 0x2800
push dword [esi + 0x124]
call fcn.1007ac47
add esp, 0xc
xor edi, edi
xor ecx, ecx
xor eax, eax
mov edi, edi
cmp dword [eax + 0x100db750], 8
je 0x10061406
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x100613f0
jmp 0x10061410
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x100db750]
push edi
mov ecx, esi
call fcn.10062450
push edi
mov ecx, esi
call fcn.10062b70
cmp dword [ebp - 0x248], 0x10
jb 0x10061437
push dword [ebp - 0x25c]
call fcn.1007b9e6
add esp, 4
cmp dword [ebp - 0x200], 0x10
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
jb 0x10061469
push dword [ebp - 0x214]
call fcn.1007b9e6
add esp, 4
cmp dword [ebp - 0x1b8], 0x10
mov dword [ebp - 0x200], 0xf
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x214], 0
jb 0x1006149b
push dword [ebp - 0x1cc]
call fcn.1007b9e6
add esp, 4
cmp dword [ebp - 0x1e8], 0x10
mov dword [ebp - 0x1b8], 0xf
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 0x1cc], 0
jb 0x100614cd
push dword [ebp - 0x1fc]
call fcn.1007b9e6
add esp, 4
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x1e8], 0xf
mov dword [ebp - 0x1ec], 0
mov byte [ebp - 0x1fc], 0
call fcn.10063220
lea ecx, [ebp - 0x244]
call fcn.10063220
jmp 0x1005fb96
push 0x1a1
lea ecx, [ebp - 0x55c]
call fcn.1005d210
push 0x100c97d8
mov eax, dword [eax]
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x5b4]
push eax
call fcn.100823fd
lea eax, [ebp - 0x448]
push eax
push dword [esi + 0x12c]
call edi
test eax, eax
je 0x1005f5e0
push dword [esi + 0x12c]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x100c97d8
lea eax, [ebp - 0x578]
mov dword [ebp - 0x578], 0x6d
push eax
call fcn.100823fd
mov ecx, dword [ebp - 0x5b0]
mov eax, dword [ecx + 0x128]
cmp byte [eax], 0x35
jne 0x1006158e
cmp byte [eax + 1], 0x33
jne 0x1006158e
cmp byte [eax + 2], 0x30
jne 0x1006158e
mov byte [ecx + 0x130], 0
call fcn.100615a0
push 0
push 0
call fcn.100823fd
int3