Function at 0x10007460
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10019018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x100a5fb8
call fcn.1000d4b0
test al, al
je 0x1000803b
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6b6654
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b6654], 0xa0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b6654
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b4305
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4b4305], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4b4305
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b47fe
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4b47fe], 0x75
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4b47fe
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b4856
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4b4856], 0xe9
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4b4856
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b4857
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4b4857], 0xa6
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4b4857
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b4858
call edi
lea ecx, [ebp - 0x108]
mov byte [0x4b4858], 0
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x4b4858
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4b485b
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4b485b], 0x90
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4b485b
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4bea9f
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4bea9f], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4bea9f
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4519f8
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4519f8], 2
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4519f8
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x509f1b
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x509f1b], 0xd
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x509f1b
call edi
mov bl, byte [0x100a6020]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6b7248
inc bl
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b7248], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b7248
call edi
mov bl, byte [0x100a6022]
lea eax, [ebp - 0x108]
push eax
add bl, 2
push 0x40
push 1
push 0x6b7249
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b7249], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b7249
call edi
mov bl, byte [0x100a6023]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6b724a
add bl, 3
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b724a], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b724a
call edi
mov bl, byte [0x100a6025]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6b724b
add bl, 4
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b724b], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b724b
call edi
mov bl, byte [0x100a6026]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6b724c
add bl, 5
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6b724c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6b724c
call edi
mov si, word [0x100a601e]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0x6c41bc
call edi
lea ecx, [ebp - 0x108]
push ecx
mov word [0x6c41bc], si
mov edx, dword [ebp - 0x108]
push edx
push 2
push 0x6c41bc
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x628b89
call edi
mov dword [0x628b89], 0x100a6059
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 4
push 0x628b89
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x6a74fc
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x6a74fc], 0x10007290
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x6a74fc
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x6a74d0
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x6a74d0], 0x100072b0
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x6a74d0
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x6a74ac
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x6a74ac], 0x10007380
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x6a74ac
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x6a74f8
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x6a74f8], 0x100073a0
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x6a74f8
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x548b61
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x548b61], 0x400
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x548b61
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x46ad4f
call edi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x46ad4f], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x46ad4f
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x1d
push 0x41dbb0
call edi
mov eax, 0x90909090
mov ecx, 0x41dbb0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov byte [ecx + 0x1c], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x1d
push 0x41dbb0
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x4bbab3
call edi
mov eax, 0x90909090
mov ecx, 0x4bbab3
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x4bbab3
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 6
push 0x4cbc66
call edi
mov eax, 0x90909090
mov ecx, 0x4cbc66
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 6
push 0x4cbc66
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x1e
push 0x4ecaa0
call edi
mov eax, 0x90909090
mov ecx, 0x4ecaa0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov word [ecx + 0x1c], ax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x1e
push 0x4ecaa0
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x62594a
call edi
mov eax, 0x90909090
mov ecx, 0x62594a
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x62594a
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x625996
call edi
mov eax, 0x90909090
mov ecx, 0x625996
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x625996
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 5
push 0x6259e2
call edi
mov eax, 0x90909090
mov ecx, 0x6259e2
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 5
push 0x6259e2
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x23b0
push 0x4b61d6
call edi
push 0x23b0
push 0x90
push 0x4b61d6
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x23b0
push 0x4b61d6
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 6
push 0x40d661
call edi
mov eax, 0x90909090
mov ecx, 0x40d661
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 6
push 0x40d661
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 6
push 0x40d6ed
call edi
mov eax, 0x90909090
mov ecx, 0x40d6ed
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push ecx
push edx
push 6
push 0x40d6ed
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x20
push 0x6b6694
call edi
push 0x20
push 0x100a5ffd
push 0x6b6694
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x20
push 0x6b6694
call edi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x11
push 0x6b7250
call edi
mov ecx, dword [0x100a6028]
mov eax, 0x6b7250
mov dword [eax], ecx
mov edx, dword [0x100a602c]
mov dword [eax + 4], edx
mov ecx, dword [0x100a6030]
mov dword [eax + 8], ecx
mov edx, dword [0x100a6034]
mov dword [eax + 0xc], edx
mov cl, byte [0x100a6038]
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 0x10], cl
mov eax, dword [ebp - 0x108]
push eax
push 0x11
push 0x6b7250
call edi
push 0x10004c20
push 0x596cea
mov bl, 0xe8
call fcn.100131f0
push fcn.1000d900
push 0x4db63d
or bl, 0xff
call fcn.100131f0
add esp, 0x10
mov eax, 0x100a6348
call fcn.100029a0
mov eax, 0x100cd448
call fcn.10002a20
mov eax, 0x100cda88
call fcn.10002aa0
mov edx, 0x100e70c8
call fcn.10002b70
mov eax, 0x100e7bb8
call fcn.10002c30
mov eax, 0x100eec38
call fcn.10002d10
mov eax, 0x100f0b28
call fcn.10002d70
mov eax, 0x100f2a18
call fcn.10002dd0
mov eax, 0x100f4908
call fcn.10002f20
mov eax, 0x10104ad8
call fcn.10002fb0
mov edx, 0x1012fa58
call fcn.10003030
mov ecx, 0x10132938
call fcn.10011a40
push 0
push str.DataEnc1.dat
call fcn.1000bf20
push 1
push str.DataDec2.dat
call fcn.1000bf20
cmp byte [0x100a6178], 0
je 0x10007cfd
push 0x10008c90
push 0x6198cf
mov bl, 0xe9
call fcn.100131f0
push 0x10008cf0
push 0x6119af
call fcn.100131f0
add esp, 0x10
push 0x10137d40
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100011e0
push 0
push 0
call esi
mov dword [0x10137d48], eax
call fcn.10001ff0
call fcn.10002320
push 0x100033a0
push 0x4dee30
mov bl, 0xe9
call fcn.100131f0
push 0x10003850
push 0x4df360
call fcn.100131f0
add esp, 0x10
call fcn.10003ad0
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0x6a7374
call edi
lea edx, [ebp - 0x108]
push edx
mov dword [0x6a7374], 0x10003ce0
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0x6a7374
call edi
call fcn.10003ef0
call fcn.10004140
call fcn.100049b0
push 0x10005170
push 0x5069a2
or bl, 0xff
call fcn.100131f0
push 0x10005170
push 0x5f8445
or bl, 0xff
call fcn.100131f0
push 0x100051b0
push 0x50074d
mov bl, 0xe8
call fcn.100131f0
push 0x100051b0
push 0x5fa6bb
call fcn.100131f0
call fcn.100060a0
call fcn.100067d0
push 0x10005390
push 0x402b39
mov bl, 0xe9
call fcn.100131f0
push 0x100053c0
push 0x5a3a4f
call fcn.100131f0
push 0x10005450
push 0x5d041c
call fcn.100131f0
push 0x10005480
push 0x5cf916
call fcn.100131f0
add esp, 0x40
call fcn.10004ea0
call fcn.10006c30
call fcn.10004f10
call fcn.10008070
call fcn.10008350
call fcn.100084c0
call fcn.1000c6d0
push 0x1000ff50
push 0x4b3aae
call fcn.100131f0
push 0x10010070
push 0x4b4d54
call fcn.100131f0
push 0x10010120
push 0x443154
call fcn.100131f0
push 0x10010150
push 0x443b65
call fcn.100131f0
call fcn.1000f3f0
call fcn.10010170
push fcn.10010780
push 0x5a12f0
call fcn.100131f0
push 0x10010890
push 0x5a0be0
call fcn.100131f0
push 0x10010b70
push 0x541be0
call fcn.100131f0
call fcn.10011ea0
push 0x10011a90
push 0x60f128
mov bl, 0xe8
call fcn.100131f0
add esp, 0x40
push 0x10011a90
push 0x60f145
call fcn.100131f0
push 0x10011e80
push 0x5fa7a0
mov bl, 0xe9
call fcn.100131f0
add esp, 0x10
cmp byte [0x100a617c], 0
je 0x10007f23
push 0x10013600
push 0x5e5800
call fcn.100131f0
push 0x10013950
push 0x5d5c70
call fcn.100131f0
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0x4b36eb
call edi
lea edx, [ebp - 0x108]
push edx
mov dword [0x4b36eb], 0x10013130
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0x4b36eb
call edi
test byte [0x100a5fdc], 1
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
je 0x10007f7c
push 0x100a5fdd
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x10007f7c
call fcn.1000d8e0
test byte [0x100a5fdc], 2
je 0x10007fc4
push 0x100a5ffd
lea ecx, [ebp - 0x104]
push str.SSEMU_MAIN_S1KOR__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0
push 0x1f0001
call edi
test eax, eax
jne 0x10007f77
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x100a5fb8
call fcn.1000d650
push edi
call fcn.1000d760
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
mov ecx, dword [0x10139b58]
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push ecx
push 0x10007040
push 2
call ebx
mov dword [0x10139b60], eax
call edi
mov edx, dword [0x10139b58]
push eax
push edx
push 0x100071a0
push 7
call ebx
cmp byte [0x100a617e], 0
mov dword [0x10139b5c], eax
je 0x1000802a
push 0
push 0
push 0
push 0x10007340
push 0
push 0
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001407d
mov esp, ebp
pop ebp
ret
push str.Could_not_load_ServerInfo.sse_
call fcn.100132c0
add esp, 4
call fcn.1000d8e0
int3