Function at 0x10018480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
mov esi, eax
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
test esi, esi
je 0x100189ce
mov edi, dword [ebp + 8]
test edi, edi
je 0x100189ce
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100189ce
lea ecx, [edi + 1]
call fcn.10013d20
mov edi, eax
test edi, edi
je 0x100189ce
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
call fcn.1001def0
push edi
call fcn.100240e0
push edi
call fcn.10021520
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.j_username
push edi
call esi
test eax, eax
je 0x100185d8
push str.j_password
push edi
call esi
test eax, eax
je 0x100185d8
xor eax, eax
jmp 0x10018530
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018530
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c058
call esi
push 0x1005c058
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x108]
push eax
call esi
push 0x1005c058
call esi
mov eax, 0x1005c058
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018590
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049c80]
mov dword [eax], ecx
mov cl, byte [0x10049c84]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10007740
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007140
mov esi, edi
call fcn.10013d60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.commandauth_loginByPasswordback_commandback_custom1
push edi
call esi
test eax, eax
je 0x1001869d
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100185f0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c15c
call esi
push 0x1005c15c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x108]
push ecx
call esi
push 0x1005c15c
call esi
mov eax, 0x1005c15c
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018650
mov edx, dword [str.pass.log]
mov ecx, dword [0x10049c80]
mov dword [eax], edx
mov dl, byte [0x10049c84]
mov dword [eax + 4], ecx
lea esi, [ebp - 0x108]
mov byte [eax + 8], dl
call fcn.10007740
mov eax, dword [ebp + 8]
push eax
push edi
mov eax, esi
call fcn.10007140
call fcn.1001b390
mov esi, edi
call fcn.10013d60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.edClientLogin
push edi
call esi
test eax, eax
je 0x10018779
push str.edUserLogin
push edi
call esi
test eax, eax
je 0x10018779
push str.edPassword
push edi
call esi
test eax, eax
je 0x10018779
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100186d0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c468
call esi
push 0x1005c468
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005c468
call esi
mov eax, 0x1005c468
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018730
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049c80]
mov dword [eax], ecx
mov cl, byte [0x10049c84]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10007740
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007140
push 0
push 0
push 0
push 0x1001e600
jmp 0x10018994
push str.LOGIN_AUTHORIZATION_CODE
push edi
call esi
test eax, eax
je 0x1001883d
xor eax, eax
jmp 0x10018790
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018790
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c56c
call esi
push 0x1005c56c
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call esi
push 0x1005c56c
call esi
mov eax, 0x1005c56c
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100187f0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049c80]
mov dword [eax], ecx
mov cl, byte [0x10049c84]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10007740
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007140
call fcn.1001ea20
mov esi, edi
call fcn.10013d60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.actionauthnplogin
push edi
call esi
test eax, eax
je 0x100188ed
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018850
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005c774
call esi
push 0x1005c774
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005c774
call esi
mov eax, 0x1005c774
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100188a0
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049c80]
mov dword [eax], ecx
mov cl, byte [0x10049c84]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10007740
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007140
call fcn.1001f930
mov esi, edi
call fcn.10013d60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.CryptoPluginIdAGAVASign
push edi
call esi
test eax, eax
je 0x100189c7
xor eax, eax
nop
mov cl, byte [eax + 0x10059d68]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x10018900
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x1005cf94
call esi
push 0x1005cf94
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x1005cf94
call esi
mov eax, 0x1005cf94
call fcn.100031c0
lea esi, [ebp - 0x108]
call fcn.10007700
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10018950
mov ecx, dword [str.pass.log]
mov edx, dword [0x10049c80]
mov dword [eax], ecx
mov cl, byte [0x10049c84]
mov dword [eax + 4], edx
lea esi, [ebp - 0x108]
mov byte [eax + 8], cl
call fcn.10007740
mov edx, dword [ebp + 8]
push edx
push edi
mov eax, esi
call fcn.10007140
push 0
push 0
push 0
push 0x100231a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x100189c7
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100189c7
test byte [ebp + 8], 2
jne 0x100189c7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
call fcn.10013d60
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4