Function at 0x10016ba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x100170ee
mov edi, dword [ebp + 8]
test edi, edi
je 0x100170ee
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100170ee
lea ecx, [edi + 1]
call fcn.10012420
mov edi, eax
test edi, edi
je 0x100170ee
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
call fcn.1001c660
push edi
call fcn.100237d0
push edi
call fcn.1001fd80
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.j_username
push edi
call esi
test eax, eax
je 0x10016cf8
push str.j_password
push edi
call esi
test eax, eax
je 0x10016cf8
xor eax, eax
jmp 0x10016c50
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10016c50
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d148
call esi
push 0x1005d148
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x108]
push eax
call esi
push 0x1005d148
call esi
mov eax, 0x1005d148
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016cb0
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10005b50
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10005550
mov esi, edi
call fcn.10012460
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.commandauth_loginByPasswordback_commandback_custom1
push edi
call esi
test eax, eax
je 0x10016dbd
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10016d10
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d24c
call esi
push 0x1005d24c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
push 0x1005d24c
call esi
mov eax, 0x1005d24c
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016d70
mov edx, dword [str.pass.log]
mov ecx, dword [0x1004a0f8]
mov dword [eax], edx
mov dl, byte [0x1004a0fc]
mov dword [eax + 4], ecx
lea esi, [ebp - 0x108]
mov byte [eax + 8], dl
call fcn.10005b50
mov eax, dword [ebp + 8]
push eax
push edi
mov eax, esi
call fcn.10005550
call fcn.10019ad0
mov esi, edi
call fcn.10012460
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.edClientLogin
push edi
call esi
test eax, eax
je 0x10016e99
push str.edUserLogin
push edi
call esi
test eax, eax
je 0x10016e99
push str.edPassword
push edi
call esi
test eax, eax
je 0x10016e99
xor eax, eax
nop
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10016df0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d558
call esi
push 0x1005d558
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005d558
call esi
mov eax, 0x1005d558
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016e50
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10005b50
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10005550
push 0
push 0
push 0
push 0x1001cd70
jmp 0x100170b4
push str.LOGIN_AUTHORIZATION_CODE
push edi
call esi
test eax, eax
je 0x10016f5d
xor eax, eax
jmp 0x10016eb0
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10016eb0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d65c
call esi
push 0x1005d65c
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005d65c
call esi
mov eax, 0x1005d65c
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016f10
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10005b50
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10005550
call fcn.1001d1a0
mov esi, edi
call fcn.10012460
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.actionauthnplogin
push edi
call esi
test eax, eax
je 0x1001700d
xor eax, eax
nop
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10016f70
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005d864
call esi
push 0x1005d864
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005d864
call esi
mov eax, 0x1005d864
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016fc0
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10005b50
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10005550
call fcn.1001e0e0
mov esi, edi
call fcn.10012460
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.CryptoPluginIdAGAVASign
push edi
call esi
test eax, eax
je 0x100170e7
xor eax, eax
nop
mov cl, byte [eax + 0x1005ae00]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10017020
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005e084
call esi
push 0x1005e084
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005e084
call esi
mov eax, 0x1005e084
call fcn.10003220
lea esi, [ebp - 0x108]
call fcn.10005b10
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10017070
mov ecx, dword [str.pass.log]
mov edx, dword [0x1004a0f8]
mov dword [eax], ecx
mov cl, byte [0x1004a0fc]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10005b50
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10005550
push 0
push 0
push 0
push 0x10021ab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100170e7
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100170e7
test byte [ebp + 8], 2
jne 0x100170e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.10012460
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4