Function at 0x100189d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x10018f1e
mov edi, dword [ebp + 8]
test edi, edi
je 0x10018f1e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10018f1e
lea ecx, [edi + 1]
call fcn.10014170
mov edi, eax
test edi, edi
je 0x10018f1e
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
call fcn.1001e3f0
push edi
call fcn.100244a0
push edi
call fcn.10021a60
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.j_username
push edi
call esi
test eax, eax
je 0x10018b28
push str.j_password
push edi
call esi
test eax, eax
je 0x10018b28
xor eax, eax
jmp 0x10018a80
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018a80
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c058
call esi
push 0x1005c058
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x108]
push eax
call esi
push 0x1005c058
call esi
mov eax, 0x1005c058
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018ae0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100079c0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007350
mov esi, edi
call fcn.100141b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.commandauth_loginByPasswordback_commandback_custom1
push edi
call esi
test eax, eax
je 0x10018bed
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018b40
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c15c
call esi
push 0x1005c15c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
push 0x1005c15c
call esi
mov eax, 0x1005c15c
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018ba0
mov edx, dword [str.pass.log]
mov ecx, dword [0x10049cd0]
mov dword [eax], edx
mov dl, byte [0x10049cd4]
mov dword [eax + 4], ecx
lea esi, [ebp - 0x108]
mov byte [eax + 8], dl
call fcn.100079c0
mov eax, dword [ebp + 8]
push eax
push edi
mov eax, esi
call fcn.10007350
call fcn.1001b890
mov esi, edi
call fcn.100141b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.edClientLogin
push edi
call esi
test eax, eax
je 0x10018cc9
push str.edUserLogin
push edi
call esi
test eax, eax
je 0x10018cc9
push str.edPassword
push edi
call esi
test eax, eax
je 0x10018cc9
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018c20
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c468
call esi
push 0x1005c468
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005c468
call esi
mov eax, 0x1005c468
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018c80
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100079c0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007350
push 0
push 0
push 0
push 0x1001eb00
jmp 0x10018ee4
push str.LOGIN_AUTHORIZATION_CODE
push edi
call esi
test eax, eax
je 0x10018d8d
xor eax, eax
jmp 0x10018ce0
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018ce0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c56c
call esi
push 0x1005c56c
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005c56c
call esi
mov eax, 0x1005c56c
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018d40
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100079c0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007350
call fcn.1001ef20
mov esi, edi
call fcn.100141b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.actionauthnplogin
push edi
call esi
test eax, eax
je 0x10018e3d
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018da0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c774
call esi
push 0x1005c774
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005c774
call esi
mov eax, 0x1005c774
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018df0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100079c0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007350
call fcn.1001fe20
mov esi, edi
call fcn.100141b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.CryptoPluginIdAGAVASign
push edi
call esi
test eax, eax
je 0x10018f17
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018e50
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005cf94
call esi
push 0x1005cf94
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005cf94
call esi
mov eax, 0x1005cf94
call fcn.10003080
lea esi, [ebp - 0x108]
call fcn.10007980
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018ea0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049cd0]
mov dword [eax], ecx
mov cl, byte [0x10049cd4]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.100079c0
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007350
push 0
push 0
push 0
push 0x10023570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10018f17
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10018f17
test byte [ebp + 8], 2
jne 0x10018f17
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.100141b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4