Function at 0x1000a7c0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100347d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push esi
push edi
jmp 0x1000a7f3
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x140]
push ebx
push 2
rep stosd dword es:[edi], eax
mov dword [ebp - 0x144], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x144]
push eax
push edi
mov dword [ebp - 0x1c], edi
call sub.KERNEL32.dll_Process32First
mov esi, 1
mov byte [ebp - 0x18], 0x34
mov byte [ebp - 0x17], 0x29
mov byte [ebp - 0x16], 0x28
mov byte [ebp - 0x15], 0x3c
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], bl
xor eax, eax
mov cl, byte [ebp + eax - 0x18]
xor cl, 0x64
mov byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 6
jb 0x1000a84a
lea ecx, [ebp - 0x18]
push ecx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
je 0x1000a8a7
mov ecx, 0x10048cd8
call fcn.10010670
push ebx
push 0x10
push 0x10043edc
call fcn.1002fece
cmp dword [0x10048f48], esi
jne 0x1000a8a2
mov ecx, 0x10048c20
call fcn.10005410
mov ecx, 0x10048c20
call fcn.100055e0
call fcn.10002ee0
mov edx, dword [0x10044578]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.1002c9db
mov ecx, dword [ebp - 0x10]
push str.scap.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.Camtasia.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.ly.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.captivate.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.Capture.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.EasySnap.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.fsVideo.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.HprSnap.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.Courseware.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.HTServer.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.HyCam.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.lcsc.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.m4uscreen.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.scrcam.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.MYSCRMYCUT.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push 0x10043e04
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.sph.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.RdfSnap.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.ScreenCapture.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.SnagIt.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.ScreenVCR.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.wmenc.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.screen.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.view.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.letcam.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.audio.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.lxj.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.snap.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.Vampire.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.WebEx.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov ecx, dword [ebp - 0x10]
push str.FlashBack_Recorder.exe
push ecx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov edx, dword [ebp - 0x10]
push str.RecorderChecker.exe
push edx
call fcn.10019764
add esp, 8
test eax, eax
je 0x1000abdf
mov eax, dword [ebp - 0x10]
push str.YouCam.exe
push eax
call fcn.10019764
add esp, 8
test eax, eax
jne 0x1000ac57
mov ecx, 0x10048cd8
call fcn.10010670
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x243]
mov byte [ebp - 0x244], bl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
stosw word es:[edi], ax
mov eax, dword [ecx - 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.1002cb5b
push eax
lea edx, [ebp - 0x244]
push 0x10043cf0
push edx
call fcn.10018b70
add esp, 0xc
lea eax, [ebp - 0x244]
push ebx
push 0x10
push eax
call fcn.1002fece
cmp dword [0x10048f48], esi
jne 0x1000ac4f
mov ecx, 0x10048c20
call fcn.10005410
mov ecx, 0x10048c20
call fcn.100055e0
call fcn.10002ee0
mov edi, dword [ebp - 0x1c]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1002c896
lea ecx, [ebp - 0x144]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
cmp eax, esi
je 0x1000a82d
jmp 0x1000ac93
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret