Function at 0x1003cbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100b8961
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x100d3fe0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d3fe0]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov esi, dword [esp + 0xd4]
mov ebp, ecx
mov dword [esp + 0x44], ebp
test esi, esi
je 0x1003d5ec
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003cc15
sub eax, edx
je 0x1003d5ec
lea ecx, [esp + 0x98]
call fcn.10019010
push esi
lea ecx, [esp + 0x9c]
mov dword [esp + 0xd0], 0
call fcn.10018e10
lea ecx, [esp + 0x50]
call fcn.10018f70
mov eax, dword [0x100d302c]
mov dword [esp + 0x14], eax
mov ebx, eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x9c]
mov byte [esp + 0xd0], 3
call fcn.10018e70
test eax, eax
je 0x1003d56f
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
mov edi, eax
test edi, edi
jne 0x1003cc96
xor esi, esi
jmp 0x1003cc9f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
lea ecx, [esp + 0x18]
call fcn.100096e0
test eax, eax
je 0x1003ccc7
mov ecx, dword [esp + 0x14]
push esi
push edi
push ecx
call fcn.1007f6e0
mov eax, dword [esp + 0x20]
mov dword [eax - 8], esi
add esp, 0xc
mov byte [esi + eax], 0
mov eax, dword [esp + 0x14]
mov ecx, str._chatkey_
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003ccf0
test dl, dl
je 0x1003ccec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003ccf0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003ccd0
xor eax, eax
jmp 0x1003ccf5
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
jne 0x1003cdf5
cmp byte [esp + 0x54], 0
mov dword [ebp + 0x104dc], esi
jne 0x1003d556
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
mov edi, eax
test edi, edi
jne 0x1003cd25
xor esi, esi
jmp 0x1003cd2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
lea ecx, [esp + 0x1c]
call fcn.100096e0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x1003cd52
push esi
push edi
push ebx
call fcn.1007f6e0
mov dword [ebx - 8], esi
add esp, 0xc
mov byte [esi + ebx], 0
mov ecx, str._disable_
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003cd80
test dl, dl
je 0x1003cd7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003cd80
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003cd60
xor eax, eax
jmp 0x1003cd85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003cd95
mov dword [ebp + 0x104dc], 1
jmp 0x1003cde5
push ebx
lea ecx, [esp + 0x40]
call fcn.10006410
lea edx, [esp + 0x3c]
push edx
lea ecx, [ebp + 0x104f8]
mov byte [esp + 0xd0], 4
call fcn.1003cac0
mov eax, dword [esp + 0x3c]
lea ecx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp ecx, dword [0x100d3010]
je 0x1003cde5
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003cde5
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003cd10
jmp 0x1003d556
push str._mailkey_
lea edx, [esp + 0x18]
push edx
call fcn.10011cf0
test al, al
je 0x1003cf45
cmp byte [esp + 0x54], 0
mov dword [ebp + 0x105a8], esi
mov dword [ebp + 0x104d4], esi
jne 0x1003d556
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
mov edi, eax
test edi, edi
jne 0x1003ce38
xor esi, esi
jmp 0x1003ce41
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
lea ecx, [esp + 0x1c]
call fcn.100096e0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x1003ce65
push esi
push edi
push ebx
call fcn.1007f6e0
mov dword [ebx - 8], esi
add esp, 0xc
mov byte [esi + ebx], 0
mov ecx, str._mail_file_
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003ce90
test dl, dl
je 0x1003ce8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003ce90
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003ce70
xor eax, eax
jmp 0x1003ce95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003cea8
mov dword [ebp + 0x105a8], 1
jmp 0x1003cf35
mov ecx, str._disable_
mov eax, ebx
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003ced0
test dl, dl
je 0x1003cecc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003ced0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003ceb0
xor eax, eax
jmp 0x1003ced5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003cee5
mov dword [ebp + 0x104d4], 1
jmp 0x1003cf35
push ebx
lea ecx, [esp + 0x3c]
call fcn.10006410
lea eax, [esp + 0x38]
push eax
lea ecx, [ebp + 0x10510]
mov byte [esp + 0xd0], 5
call fcn.1003cac0
mov eax, dword [esp + 0x38]
lea ecx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp ecx, dword [0x100d3010]
je 0x1003cf35
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003cf35
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003ce23
jmp 0x1003d556
push str._netkey_
lea edx, [esp + 0x18]
push edx
call fcn.10011cf0
test al, al
je 0x1003d055
cmp byte [esp + 0x54], 0
mov dword [ebp + 0x104d8], esi
jne 0x1003d556
lea ecx, [ecx]
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
mov edi, eax
test edi, edi
jne 0x1003cf85
xor esi, esi
jmp 0x1003cf8e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
lea ecx, [esp + 0x1c]
call fcn.100096e0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x1003cfb2
push esi
push edi
push ebx
call fcn.1007f6e0
mov dword [ebx - 8], esi
add esp, 0xc
mov byte [esi + ebx], 0
mov ecx, str._disable_
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003cfe0
test dl, dl
je 0x1003cfdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003cfe0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003cfc0
xor eax, eax
jmp 0x1003cfe5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003cff5
mov dword [ebp + 0x104d8], 1
jmp 0x1003d045
push ebx
lea ecx, [esp + 0x44]
call fcn.10006410
lea eax, [esp + 0x40]
push eax
lea ecx, [ebp + 0x10528]
mov byte [esp + 0xd0], 6
call fcn.1003cac0
mov eax, dword [esp + 0x40]
lea ecx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp ecx, dword [0x100d3010]
je 0x1003d045
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d045
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003cf70
jmp 0x1003d556
push str._process_
lea edx, [esp + 0x18]
push edx
call fcn.10011cf0
test al, al
je 0x1003d0f4
cmp dword [esp + 0xd8], esi
je 0x1003d556
cmp byte [esp + 0x54], 0
jne 0x1003d556
lea edi, [ebp + 0x10540]
jmp 0x1003d092
xor esi, esi
push esi
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
lea ecx, [esp + 0x50]
call fcn.10006410
lea eax, [esp + 0x4c]
push eax
mov ecx, edi
mov byte [esp + 0xd0], 7
call fcn.1003cac0
mov eax, dword [esp + 0x4c]
lea ecx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp ecx, dword [0x100d3010]
je 0x1003d0e8
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d0e8
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003d090
jmp 0x1003d556
push str._filekey_
lea edx, [esp + 0x18]
push edx
call fcn.10011cf0
test al, al
je 0x1003d201
push esi
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
call fcn.1008116f
add esp, 4
push eax
lea ecx, [ebp + 0x74]
call fcn.1000a1d0
cmp byte [esp + 0x54], 0
mov dword [ebp + 0x104d0], esi
jne 0x1003d556
jmp 0x1003d140
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
mov edi, eax
test edi, edi
jne 0x1003d155
xor esi, esi
jmp 0x1003d15e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push esi
lea ecx, [esp + 0x1c]
call fcn.100096e0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x1003d182
push esi
push edi
push ebx
call fcn.1007f6e0
mov dword [ebx - 8], esi
add esp, 0xc
mov byte [esi + ebx], 0
push str._disable_
lea eax, [esp + 0x1c]
push eax
call fcn.10011cf0
test al, al
je 0x1003d1a1
mov dword [ebp + 0x104d0], 1
jmp 0x1003d1f1
push ebx
lea ecx, [esp + 0x34]
call fcn.10006410
lea ecx, [esp + 0x30]
push ecx
lea ecx, [ebp + 0x104e0]
mov byte [esp + 0xd0], 8
call fcn.1003cac0
mov eax, dword [esp + 0x30]
lea edx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp edx, dword [0x100d3010]
je 0x1003d1f1
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d1f1
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003d140
jmp 0x1003d556
push str._url_
lea eax, [esp + 0x18]
push eax
call fcn.10011cf0
test al, al
je 0x1003d2d5
cmp dword [esp + 0xd8], esi
je 0x1003d556
push esi
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
call fcn.1008116f
add esp, 4
cmp byte [esp + 0x54], 0
mov dword [ebp + 0x1058c], eax
jne 0x1003d556
mov ebp, dword [esp + 0x44]
add ebp, 0x10570
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
lea ecx, [esp + 0x4c]
call fcn.10001bc0
mov esi, dword [ebp + 0x14]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x48]
push ecx
push edx
push esi
mov ecx, ebp
mov byte [esp + 0xd8], 9
call fcn.10037680
push 1
mov ecx, ebp
mov edi, eax
call fcn.10039420
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x48]
lea ecx, [eax - 0xc]
mov byte [esp + 0xcc], 3
cmp ecx, dword [0x100d3028]
je 0x1003d2c5
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d2c5
push esi
call fcn.1007f6d5
add esp, 4
cmp byte [esp + 0x54], 0
je 0x1003d253
mov ebp, dword [esp + 0x44]
jmp 0x1003d556
push str._window_
lea edx, [esp + 0x18]
push edx
call fcn.10011cf0
test al, al
je 0x1003d356
cmp dword [esp + 0xd8], esi
je 0x1003d556
cmp byte [esp + 0x54], 0
jne 0x1003d556
lea esi, [ebp + 0x10558]
jmp 0x1003d310
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
lea ecx, [esp + 0x38]
call fcn.10006410
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov byte [esp + 0xd0], 0xa
call fcn.1003cac0
lea ecx, [esp + 0x34]
mov byte [esp + 0xcc], 3
call fcn.10001810
cmp byte [esp + 0x54], 0
je 0x1003d310
jmp 0x1003d556
push str._ipport_
lea ecx, [esp + 0x18]
push ecx
call fcn.10011cf0
test al, al
je 0x1003d4db
cmp dword [esp + 0xd8], esi
je 0x1003d556
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
call fcn.1008116f
add esp, 4
push 0
lea ecx, [esp + 0x54]
mov esi, eax
call fcn.10018ae0
push eax
call fcn.1008116f
mov edx, dword [0x100d302c]
add esp, 4
mov edi, eax
mov dword [esp + 0x24], edx
mov byte [esp + 0xcc], 0xb
test esi, esi
je 0x1003d3c8
mov eax, 1
mov word [esp + 0x22], ax
jmp 0x1003d3d2
mov ecx, 2
mov word [esp + 0x22], cx
lea ecx, [esp + 0x74]
call fcn.10018f70
cmp byte [esp + 0x54], 0
mov byte [esp + 0xcc], 0xc
jne 0x1003d487
mov edi, edi
push 0
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
lea ecx, [esp + 0x78]
call fcn.10018b90
push 0
lea ecx, [esp + 0x78]
mov byte [esp + 0x7d], 0x3a
mov byte [esp + 0x7e], 0
call fcn.10018ae0
push eax
lea ecx, [esp + 0x28]
call fcn.10009830
push 0
lea ecx, [esp + 0x78]
call fcn.10018ae0
push eax
call fcn.1008116f
add esp, 4
push 0
lea ecx, [esp + 0x78]
movzx esi, ax
call fcn.10018ae0
mov edx, dword [esp + 0x24]
push edx
call fcn.10033530
add esp, 4
rol si, 8
movzx ecx, si
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], cx
test eax, eax
jne 0x1003d46c
test cx, cx
je 0x1003d47c
lea eax, [esp + 0x1c]
push eax
lea ecx, [ebp + 0x10590]
call fcn.1003cb40
cmp byte [esp + 0x54], 0
je 0x1003d3f0
test edi, edi
je 0x1003d4b4
mov ecx, 3
lea eax, [esp + 0x1c]
mov word [esp + 0x22], cx
xor edx, edx
push eax
lea ecx, [ebp + 0x10590]
mov dword [esp + 0x20], 0
mov word [esp + 0x24], dx
call fcn.1003cb40
lea ecx, [esp + 0x74]
mov byte [esp + 0xcc], 0xb
call fcn.100189e0
lea ecx, [esp + 0x24]
mov byte [esp + 0xcc], 3
call fcn.10001b90
jmp 0x1003d556
push str._hw_
lea ecx, [esp + 0x18]
push ecx
call fcn.10011cf0
test al, al
je 0x1003d556
cmp dword [esp + 0xd8], esi
je 0x1003d556
cmp byte [esp + 0x54], 0
jne 0x1003d556
mov edi, edi
push esi
lea ecx, [esp + 0x54]
call fcn.10018ae0
push eax
lea ecx, [esp + 0x30]
call fcn.10001bc0
push esi
lea ecx, [esp + 0x54]
mov byte [esp + 0xd0], 0xd
call fcn.10018ae0
push eax
call fcn.1008116f
mov edx, dword [esp + 0x30]
add esp, 4
push eax
push edx
lea ecx, [esp + 0x33]
call fcn.10022370
lea ecx, [esp + 0x2c]
mov byte [esp + 0xcc], 3
call fcn.10001b90
cmp byte [esp + 0x54], 0
je 0x1003d500
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x9c]
call fcn.10018e70
test eax, eax
jne 0x1003cc81
lea ecx, [ebx - 0xc]
cmp ecx, dword [0x100d3028]
je 0x1003d591
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d591
push esi
call fcn.1007f6d5
add esp, 4
mov esi, dword [esp + 0x14]
lea edx, [esi - 0xc]
cmp edx, dword [0x100d3028]
je 0x1003d5b7
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1003d5b7
push esi
call fcn.1007f6d5
add esp, 4
mov eax, dword [esp + 0x68]
push eax
mov byte [esp + 0xd0], 0
call fcn.1007f6d5
add esp, 4
lea ecx, [esp + 0x58]
call fcn.1007ba60
lea ecx, [esp + 0x98]
mov dword [esp + 0xcc], 0xffffffff
call fcn.10018d20
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.1007fec9
add esp, 0xbc
ret 8