Function at 0x100054d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10013018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x100800a0
call fcn.1000aaa0
test al, al
je 0x10005f23
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x605ee4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x605ee4], 0xa0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x605ee4
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x482c29
call esi
mov bl, 0xeb
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x482c29], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x482c29
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x482ca2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x482ca2], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x482ca2
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4830a6
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4830a6], 3
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4830a6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4830e7
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4830e7], 3
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4830e7
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x483128
call esi
lea ecx, [ebp - 0x108]
mov byte [0x483128], 3
push ecx
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x483128
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4cdd8b
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4cdd8b], 0xd
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4cdd8b
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x523f8e
call esi
mov bl, 0xff
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x523f8e], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x523f8e
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x523f93
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x523f93], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x523f93
call esi
mov bl, byte [0x10080108]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6069ec
inc bl
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6069ec], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6069ec
call esi
mov bl, byte [0x1008010a]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6069ed
add bl, 2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6069ed], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6069ed
call esi
mov bl, byte [0x1008010b]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6069ee
add bl, 3
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6069ee], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6069ee
call esi
mov bl, byte [0x1008010d]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6069ef
add bl, 4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6069ef], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6069ef
call esi
mov bl, byte [0x1008010e]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x6069f0
add bl, 5
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x6069f0], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x6069f0
call esi
mov di, word [0x10080106]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0x61065c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov word [0x61065c], di
mov edx, dword [ebp - 0x108]
push edx
push 2
push 0x61065c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x481b93
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x481b93], 0x10080121
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x481b93
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x5c86ab
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x5c86ab], 0x10080141
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x5c86ab
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x5fa368
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x5fa368], 0x100053e0
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x5fa368
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x5fa3f0
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x5fa3f0], 0x10005400
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x5fa3f0
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0x566ddb
call esi
mov ecx, 0x200
lea edx, [ebp - 0x108]
push edx
mov word [0x566ddb], cx
mov eax, dword [ebp - 0x108]
push eax
push 2
push 0x566ddb
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0x500621
call esi
lea edx, [ebp - 0x108]
push edx
mov dword [0x500621], 0x200
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0x500621
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 0x1d
push 0x414e30
call esi
mov eax, 0x90909090
mov ecx, 0x414e30
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
lea edx, [ebp - 0x108]
push edx
mov byte [ecx + 0x1c], al
mov eax, dword [ebp - 0x108]
push eax
push 0x1d
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 5
push 0x47a64c
call esi
mov ecx, 0x47a64c
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
mov byte [ecx + 4], al
mov eax, dword [ebp - 0x108]
push eax
push 5
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 5
push 0x47a661
call esi
mov ecx, 0x47a661
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
mov byte [ecx + 4], al
mov eax, dword [ebp - 0x108]
push eax
push 5
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 6
push 0x498045
call esi
mov ecx, 0x498045
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x108]
push eax
push 6
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 0x1e
push 0x4b2d90
call esi
mov eax, 0x90909090
mov ecx, 0x4b2d90
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
lea edx, [ebp - 0x108]
push edx
mov word [ecx + 0x1c], ax
mov eax, dword [ebp - 0x108]
push eax
push 0x1e
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 6
push 0x40a65d
call esi
mov ecx, 0x40a65d
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x108]
push eax
push 6
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 6
push 0x40a6e9
call esi
mov ecx, 0x40a6e9
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [ebp - 0x108]
push edx
mov word [ecx + 4], ax
mov eax, dword [ebp - 0x108]
push eax
push 6
push ecx
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 0x20
push 0x605fa6
call esi
push 0x20
push 0x100800e5
push 0x605fa6
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 0x108]
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push eax
push 0x20
push 0x605fa6
call esi
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 0x11
push 0x6069f4
call esi
mov edx, dword [0x10080110]
mov eax, 0x6069f4
mov dword [eax], edx
mov ecx, dword [0x10080114]
mov dword [eax + 4], ecx
mov edx, dword [0x10080118]
mov dword [eax + 8], edx
mov ecx, dword [0x1008011c]
mov dword [eax + 0xc], ecx
mov dl, byte [0x10080120]
mov byte [eax + 0x10], dl
mov ecx, dword [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
push ecx
push 0x11
push 0x6069f4
call esi
push 0x10003fb0
push 0x5443af
mov bl, 0xe8
call fcn.1000ed40
push 0x1000af10
push 0x4a3b8b
or bl, 0xff
call fcn.1000ed40
add esp, 0x10
mov eax, 0x10080384
call fcn.10002440
mov eax, 0x100a7484
call fcn.10002650
mov eax, 0x100a7ac4
call fcn.100024c0
mov edx, 0x100aaec4
call fcn.10002590
mov eax, 0x100abb44
call fcn.10002720
mov eax, 0x100ada34
call fcn.10002780
mov eax, 0x100af924
call fcn.100027e0
mov eax, 0x100b1814
call fcn.10002930
mov eax, 0x100c19e4
call fcn.100029c0
push 0
push str.DataEnc1.dat
call fcn.100095d0
push 1
push str.DataDec2.dat
call fcn.100095d0
cmp byte [0x10080270], 0
je 0x10005c1f
push 0x10006720
push 0x5bc2b3
mov bl, 0xe9
call fcn.1000ed40
push 0x10006770
push 0x5b5f41
call fcn.1000ed40
add esp, 0x10
push 0x10001f20
push 0x42bb3c
mov bl, 0xe8
call fcn.1000ed40
push 0x10001f20
push 0x5963f0
call fcn.1000ed40
push 0x10002090
push 0x42bb9c
call fcn.1000ed40
push 0x10002000
push 0x596430
call fcn.1000ed40
call fcn.10002130
push 0x10002a10
push 0x4a6680
mov bl, 0xe9
call fcn.1000ed40
push 0x10002d40
push 0x4a68f0
call fcn.1000ed40
add esp, 0x30
call fcn.10002e50
lea edx, [ebp - 0x108]
push edx
push 0x40
push 4
push 0x5fa2ec
call esi
lea eax, [ebp - 0x108]
push eax
mov dword [0x5fa2ec], 0x10002fd0
mov ecx, dword [ebp - 0x108]
push ecx
push 4
push 0x5fa2ec
call esi
call fcn.100031e0
call fcn.10003440
call fcn.10003d40
push 0x10004230
push 0x4cb0c6
or bl, 0xff
call fcn.1000ed40
push 0x10004230
push 0x5a0295
or bl, 0xff
call fcn.1000ed40
push 0x10004270
push 0x4c5b82
mov bl, 0xe8
call fcn.1000ed40
push 0x10004270
push 0x5a2162
call fcn.1000ed40
call fcn.10004410
push 0x10004b20
push 0x58f7aa
call fcn.1000ed40
push 0x10004b20
push 0x58f8bb
call fcn.1000ed40
push 0x10004b50
push 0x553040
call fcn.1000ed40
call fcn.10004df0
call fcn.10005f60
call fcn.10006100
call fcn.10009f20
push 0x1000c690
push 0x482048
mov bl, 0xe9
call fcn.1000ed40
add esp, 0x40
push 0x1000c7b0
push 0x48300c
call fcn.1000ed40
push 0x1000c840
push 0x427434
call fcn.1000ed40
push 0x1000c870
push 0x427e15
call fcn.1000ed40
call fcn.1000bc60
call fcn.1000c890
push fcn.1000ca00
push 0x54d270
call fcn.1000ed40
push 0x1000caf0
push 0x54cb60
call fcn.1000ed40
push 0x1000cdd0
push 0x4fa210
call fcn.1000ed40
push 0x1000d620
push 0x55695d
call fcn.1000ed40
call fcn.1000dda0
push 0x1000dc60
push 0x5b388d
mov bl, 0xe8
call fcn.1000ed40
add esp, 0x40
push 0x1000dc60
push 0x5b38aa
call fcn.1000ed40
push 0x1000dd80
push 0x5a2210
mov bl, 0xe9
call fcn.1000ed40
add esp, 0x10
cmp byte [0x10080273], 0
je 0x10005e43
push 0x1000f0a0
push 0x58e5b0
call fcn.1000ed40
push 0x1000f3e0
push 0x57e240
call fcn.1000ed40
add esp, 0x10
test byte [0x100800c4], 1
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
je 0x10005e6c
push 0x100800c5
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10005e6c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [0x100800c4], 2
je 0x10005eb2
push 0x100800e5
lea edx, [ebp - 0x104]
push str.SSEMU_MAIN_99CHS__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10005e64
lea ecx, [ebp - 0x104]
push ecx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x100800a0
call fcn.1000ac40
push edi
call fcn.1000ad60
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov edx, dword [0x100eeb3c]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push edx
push 0x10005200
push 2
call edi
mov dword [0x100eeb44], eax
call esi
push eax
mov eax, dword [0x100eeb3c]
push eax
push 0x100052f0
push 7
call edi
push 0
push 0
push 0
push 0x10005490
push 0
push 0
mov dword [0x100eeb40], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000faed
mov esp, ebp
pop ebp
ret
push str.Could_not_load_ServerInfo.sse_
call fcn.1000ee10
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]