Function at 0x10013560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.ntdll.dll_memset
add esp, 0xc
test esi, esi
je 0x100139ee
mov edi, dword [ebp + 8]
test edi, edi
je 0x100139ee
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100139ee
lea ecx, [edi + 1]
call fcn.1000e7e0
mov edi, eax
test edi, edi
je 0x100139ee
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
call fcn.10019710
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.j_username
push edi
call esi
test eax, eax
je 0x100136a8
push str.j_password
push edi
call esi
test eax, eax
je 0x100136a8
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10013600
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10058650
call esi
push 0x10058650
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x108]
push eax
call esi
push 0x10058650
call esi
mov eax, 0x10058650
call fcn.10003430
lea esi, [ebp - 0x108]
call fcn.100075b0
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013660
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004879c]
mov dword [eax], ecx
mov cl, byte [0x100487a0]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100075f0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10006ff0
mov esi, edi
call fcn.1000e820
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.commandauth_loginByPasswordback_commandback_custom1
push edi
call esi
test eax, eax
je 0x1001376d
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100136c0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10058754
call esi
push 0x10058754
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
push 0x10058754
call esi
mov eax, 0x10058754
call fcn.10003430
lea esi, [ebp - 0x108]
call fcn.100075b0
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013720
mov edx, dword [str.pass.log]
mov ecx, dword [0x1004879c]
mov dword [eax], edx
mov dl, byte [0x100487a0]
mov dword [eax + 4], ecx
lea esi, [ebp - 0x108]
mov byte [eax + 8], dl
call fcn.100075f0
mov eax, dword [ebp + 8]
push eax
push edi
mov eax, esi
call fcn.10006ff0
call fcn.10016930
mov esi, edi
call fcn.1000e820
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.edClientLogin
push edi
call esi
test eax, eax
je 0x10013849
push str.edUserLogin
push edi
call esi
test eax, eax
je 0x10013849
push str.edPassword
push edi
call esi
test eax, eax
je 0x10013849
xor eax, eax
nop
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100137a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10058a60
call esi
push 0x10058a60
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x10058a60
call esi
mov eax, 0x10058a60
call fcn.10003430
lea esi, [ebp - 0x108]
call fcn.100075b0
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013800
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004879c]
mov dword [eax], ecx
mov cl, byte [0x100487a0]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100075f0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10006ff0
push 0
push 0
push 0
push 0x10019b20
jmp 0x100139b4
push str.LOGIN_AUTHORIZATION_CODE
push edi
call esi
test eax, eax
je 0x1001390d
xor eax, eax
jmp 0x10013860
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10013860
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10058b64
call esi
push 0x10058b64
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x10058b64
call esi
mov eax, 0x10058b64
call fcn.10003430
lea esi, [ebp - 0x108]
call fcn.100075b0
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100138c0
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004879c]
mov dword [eax], ecx
mov cl, byte [0x100487a0]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100075f0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10006ff0
call fcn.10019f60
mov esi, edi
call fcn.1000e820
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.CryptoPluginIdAGAVASign
push edi
call esi
test eax, eax
je 0x100139e7
xor eax, eax
nop
mov cl, byte [eax + 0x10055868]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10013920
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005958c
call esi
push 0x1005958c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005958c
call esi
mov eax, 0x1005958c
call fcn.10003430
lea esi, [ebp - 0x108]
call fcn.100075b0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013970
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004879c]
mov dword [eax], ecx
mov cl, byte [0x100487a0]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100075f0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10006ff0
push 0
push 0
push 0
push 0x1001da70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100139e7
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100139e7
test byte [ebp + 8], 2
jne 0x100139e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.1000e820
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4