Function at 0x100051d0
Capabilities:
Allocate or change rwx memory
Create directory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x100a4478
call fcn.10009840
test al, al
je 0x10005d74
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9556
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d9556], 0xe9
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9556
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9557
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d9557], 0x8b
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9557
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9558
call esi
xor bl, bl
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d9558], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9558
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9559
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d9559], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9559
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d955a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d955a], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d955a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9176
call esi
lea ecx, [ebp - 0x108]
mov byte [0x4d9176], 0xeb
push ecx
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9176
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4d9513
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x4d9513], 0x75
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x4d9513
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43e510
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43e510], 0x50
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43e510
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43e519
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43e519], 0x50
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43e519
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43e521
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43e521], 0x18
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43e521
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43dfd9
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43dfd9], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43dfd9
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43e098
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43e098], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43e098
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43ec4b
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43ec4b], 0xb0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43ec4b
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43ec4c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43ec4c], 1
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43ec4c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x43ec4d
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x43ec4d], 0x90
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x43ec4d
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x9cdf5a
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x9cdf5a], 7
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x9cdf5a
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x52ab21
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x52ab21], 0xeb
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x52ab21
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x9d20df
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x9d20df], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x9d20df
call esi
mov bl, byte [0x100a44e0]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x118ef48
inc bl
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x118ef48], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x118ef48
call esi
mov bl, byte [0x100a44e2]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x118ef49
add bl, 2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x118ef49], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x118ef49
call esi
mov bl, byte [0x100a44e3]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x118ef4a
add bl, 3
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x118ef4a], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x118ef4a
call esi
mov bl, byte [0x100a44e5]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x118ef4b
add bl, 4
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x118ef4b], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x118ef4b
call esi
mov bl, byte [0x100a44e6]
lea eax, [ebp - 0x108]
push eax
push 0x40
add bl, 5
push 1
push 0x118ef4c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov byte [0x118ef4c], bl
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x118ef4c
call esi
mov di, word [0x100a44de]
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0x118d31c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov word [0x118d31c], di
mov edx, dword [ebp - 0x108]
push edx
push 2
push 0x118d31c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4d7fbf
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4d7fbf], 0x100a44f9
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4d7fbf
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x4e0f40
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x4e0f40], 0x100a4519
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x4e0f40
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xffc82c
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xffc82c], 0x100050e0
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xffc82c
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0xffc858
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0xffc858], 0x10005100
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0xffc858
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f3cdb
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f3cdb], 0x1001609c
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f3cdb
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f3d25
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f3d25], 0x10016074
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f3d25
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f3d59
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f3d59], 0x1001604c
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f3d59
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f6b95
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f6b95], 0x10016038
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f6b95
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f6be2
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f6be2], 0x10016020
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f6be2
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f1668
call esi
lea ecx, [ebp - 0x108]
mov dword [0x9f1668], 0x10016010
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 4
push 0x9f1668
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x9f1758
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x9f1758], 0x10015ffc
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x9f1758
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x588f68
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x588f68], 0x11e
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x588f68
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x588fa9
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x588fa9], 0x142
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x588fa9
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x588fea
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x588fea], 0x166
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x588fea
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 4
push 0x58902b
call esi
lea ecx, [ebp - 0x108]
push ecx
mov dword [0x58902b], 0x18a
mov edx, dword [ebp - 0x108]
push edx
push 4
push 0x58902b
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 1
push 0x4592d8
call esi
mov byte [0x4592d8], 0xeb
lea ecx, [ebp - 0x108]
mov edx, dword [ebp - 0x108]
push ecx
push edx
push 1
push 0x4592d8
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x3d
push 0x5528b6
call esi
push 0x3d
push 0x90
push 0x5528b6
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x108]
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push edx
push 0x3d
push 0x5528b6
call esi
lea eax, [ebp - 0x108]
push eax
push 0x40
push 2
push 0x6cccaa
call esi
mov edx, 0x6cccaa
mov ecx, 0x90909090
lea eax, [ebp - 0x108]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 0x108]
push ecx
push 2
push edx
call esi
lea edx, [ebp - 0x108]
push edx
push 0x40
push 3
push 0xa6fbfd9
call esi
mov eax, 0x90909090
mov ecx, 0xa6fbfd9
mov word [ecx], ax
mov byte [ecx + 2], al
mov ecx, dword [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
push ecx
push 3
push 0xa6fbfd9
call esi
lea edx, [ebp - 0x108]
push edx
push 0x40
push 3
push 0xa702afa
call esi
mov eax, 0x90909090
mov ecx, 0xa702afa
mov word [ecx], ax
mov byte [ecx + 2], al
mov ecx, dword [ebp - 0x108]
lea eax, [ebp - 0x108]
push eax
push ecx
push 3
push 0xa702afa
call esi
lea edx, [ebp - 0x108]
push edx
push 0x40
push 0x20
push 0x118db1a
call esi
push 0x20
push 0x100a44bd
push 0x118db1a
call sub.MSVCR100.dll_memcpy
mov ecx, dword [ebp - 0x108]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push ecx
push 0x20
push 0x118db1a
call esi
lea edx, [ebp - 0x108]
push edx
push 0x40
push 0x11
push 0x118ef50
call esi
mov ecx, dword [0x100a44e8]
mov eax, 0x118ef50
mov dword [eax], ecx
mov edx, dword [0x100a44ec]
mov dword [eax + 4], edx
mov ecx, dword [0x100a44f0]
mov dword [eax + 8], ecx
mov edx, dword [0x100a44f4]
mov dword [eax + 0xc], edx
mov cl, byte [0x100a44f8]
lea edx, [ebp - 0x108]
push edx
mov byte [eax + 0x10], cl
mov eax, dword [ebp - 0x108]
push eax
push 0x11
push 0x118ef50
call esi
push fcn.10009cb0
push 0x65e94c
or bl, 0xff
call fcn.1000d250
add esp, 8
mov eax, 0x100a4820
call fcn.10002d60
mov eax, 0x100cb920
call fcn.10002de0
mov eax, 0x100cbf60
call fcn.10002e60
mov edx, 0x100e55a0
call fcn.10002f30
mov eax, 0x100e6090
call fcn.10003180
mov eax, 0x100ea230
call fcn.10003260
mov eax, 0x100ec120
call fcn.100032c0
mov eax, 0x100ee010
call fcn.10003320
mov eax, 0x100eff00
call fcn.100034e0
mov edx, 0x1012b050
call fcn.100035a0
call fcn.10001be0
call fcn.10001f90
call fcn.10003840
lea ecx, [ebp - 0x108]
push ecx
push 0x40
push 4
push 0xffc5fc
call esi
lea edx, [ebp - 0x108]
push edx
mov dword [0xffc5fc], 0x10003bb0
mov eax, dword [ebp - 0x108]
push eax
push 4
push 0xffc5fc
call esi
call fcn.10003dc0
call fcn.100040d0
call fcn.100042a0
call fcn.10004350
call fcn.10005e20
call fcn.100021d0
call fcn.100060a0
call fcn.100082d0
call fcn.1000ad70
push 0x1000b990
push 0x987bcc
or bl, 0xff
call fcn.1000d250
push 0x1000b9f0
push 0xa7d905c
mov bl, 0xe9
call fcn.1000d250
push 0x1000bb50
push 0x62968d
call fcn.1000d250
push 0x1000bc10
push 0x7f19ff
call fcn.1000d250
add esp, 0x20
call fcn.1000bc30
call fcn.100043c0
test byte [0x100a449c], 1
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
je 0x10005cad
push 0x100a449d
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10005cad
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test byte [0x100a449c], 2
je 0x10005cf5
push 0x100a44bd
lea ecx, [ebp - 0x104]
push str.SSEMU_MAIN_S8ENG__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
push 0
push 0x1f0001
call esi
test eax, eax
jne 0x10005ca5
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, 0x100a4478
call fcn.100099e0
push edi
call fcn.10009b00
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x1012f1d0]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push ecx
push 0x10004ec0
push 2
call edi
mov dword [0x1012f1cc], eax
call esi
mov edx, dword [0x1012f1d0]
push eax
push edx
push 0x10004fa0
push 7
call edi
push 0
push 0
push 0
push 0x10005190
push 0
push 0
mov dword [0x1012f1c8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.Logs
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010263
mov esp, ebp
pop ebp
ret
push str.Could_not_load_ServerInfo.sse_
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]