Function at 0x10024f80
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100b8560]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002547b
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [edi]
call fcn.100457e0
add esp, 0x18
test al, al
jne 0x10024fcd
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100608cb
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edi]
cmp eax, 0x34
je 0x1002546b
cmp eax, 0xb8
jne 0x1002547b
cmp dword [0x1018a7a0], 0
jne 0x1002547b
cmp byte [0x1018a667], 0
je 0x1002547b
mov dword [ebp - 0x74], 0x5d
xor edx, edx
mov byte [ebp - 0x70], 0x39
mov byte [ebp - 0x6f], 0x38
mov byte [ebp - 0x6e], 0x3f
mov byte [ebp - 0x6d], 0x28
mov byte [ebp - 0x6c], 0x3a
mov byte [ebp - 0x6b], 0x67
mov byte [ebp - 0x6a], 0x67
mov byte [ebp - 0x69], 0x31
mov byte [ebp - 0x68], 0x32
mov byte [ebp - 0x67], 0x3c
mov byte [ebp - 0x66], 0x39
mov byte [ebp - 0x65], 0x2d
mov byte [ebp - 0x64], 0x3c
mov byte [ebp - 0x63], 0x3e
mov byte [ebp - 0x62], 0x36
mov byte [ebp - 0x61], 0x38
mov byte [ebp - 0x60], 0x29
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x38
mov byte [ebp - 0x5d], 0x33
mov byte [ebp - 0x5c], 0x39
mov al, byte [ebp - 0x70]
mov byte [ebp - 0x5b], 0
mov al, byte [ebp + edx - 0x70]
mov ecx, dword [ebp - 0x74]
xor cl, al
mov byte [ebp + edx - 0x70], cl
inc edx
cmp edx, 0x15
jb 0x10025061
lea eax, [ebp - 0x70]
mov byte [ebp - 0x5b], 0
push eax
call fcn.10044ed0
mov byte [ebp - 0x58], 0x74
add esp, 4
mov byte [ebp - 0x57], 0x66
xor ecx, ecx
mov byte [ebp - 0x56], 0x64
mov byte [ebp - 0x55], 0x62
mov byte [ebp - 0x54], 0x64
mov byte [ebp - 0x53], 0x2f
mov byte [ebp - 0x52], 0x62
mov byte [ebp - 0x51], 0x74
mov byte [ebp - 0x50], 0x6a
mov byte [ebp - 0x4f], 0
mov al, byte [ebp - 0x58]
mov al, byte [ebp + ecx - 0x58]
dec al
mov byte [ebp + ecx - 0x58], al
inc ecx
cmp ecx, 9
jb 0x100250b1
lea eax, [ebp - 0x58]
push eax
call fcn.1004b290
add esp, 4
test al, al
jne 0x100253b1
mov eax, dword [0x1018e398]
push 0
push 0
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 0x4c], 0x4a
mov eax, dword [ebp - 0x4c]
xor al, 0x41
mov byte [ebp - 0x48], al
mov eax, dword [ebp - 0x4c]
inc al
xor al, 0x6e
mov byte [ebp - 0x47], al
mov eax, dword [ebp - 0x4c]
add al, 2
xor al, 0x74
mov byte [ebp - 0x46], al
mov eax, dword [ebp - 0x4c]
add al, 3
xor al, 0x69
mov byte [ebp - 0x45], al
mov eax, dword [ebp - 0x4c]
add al, 4
xor al, 0x63
mov byte [ebp - 0x44], al
mov eax, dword [ebp - 0x4c]
add al, 5
xor al, 0x68
mov byte [ebp - 0x43], al
mov eax, dword [ebp - 0x4c]
add al, 6
xor al, 0x65
mov byte [ebp - 0x42], al
mov eax, dword [ebp - 0x4c]
add al, 7
xor al, 0x61
mov byte [ebp - 0x41], al
mov eax, dword [ebp - 0x4c]
add al, 8
xor al, 0x74
mov byte [ebp - 0x40], al
mov eax, dword [ebp - 0x4c]
add al, 9
xor al, 0x3a
mov byte [ebp - 0x3f], al
mov eax, dword [ebp - 0x4c]
add al, 0xa
xor al, 0x7b
mov byte [ebp - 0x3e], al
mov eax, dword [ebp - 0x4c]
add al, 0xb
xor al, 0x64
mov byte [ebp - 0x3d], al
mov eax, dword [ebp - 0x4c]
add al, 0xc
xor al, 0x61
mov byte [ebp - 0x3c], al
mov eax, dword [ebp - 0x4c]
add al, 0xd
xor al, 0x64
mov byte [ebp - 0x3b], al
mov eax, dword [ebp - 0x4c]
add al, 0xe
xor al, 0x61
mov byte [ebp - 0x3a], al
mov eax, dword [ebp - 0x4c]
add al, 0xf
xor al, 0x64
mov byte [ebp - 0x39], al
mov eax, dword [ebp - 0x4c]
add al, 0x10
xor al, 0x61
mov byte [ebp - 0x38], al
mov eax, dword [ebp - 0x4c]
add al, 0x11
xor al, 0x7d
mov byte [ebp - 0x37], al
mov eax, dword [ebp - 0x4c]
add al, 0x12
xor al, 0x20
mov byte [ebp - 0x36], al
mov eax, dword [ebp - 0x4c]
add al, 0x13
xor al, 0x73
mov byte [ebp - 0x35], al
mov eax, dword [ebp - 0x4c]
add al, 0x14
xor al, 0x65
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 0x4c]
add al, 0x15
xor al, 0x63
mov byte [ebp - 0x33], al
mov eax, dword [ebp - 0x4c]
add al, 0x16
xor al, 0x61
mov byte [ebp - 0x32], al
mov eax, dword [ebp - 0x4c]
add al, 0x17
xor al, 0x63
mov byte [ebp - 0x31], al
mov eax, dword [ebp - 0x4c]
add al, 0x18
xor al, 0x2e
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x4c]
add al, 0x19
xor al, 0x61
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x4c]
add al, 0x1a
xor al, 0x73
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x4c]
add al, 0x1b
xor al, 0x69
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x4c]
add al, 0x1c
xor al, 0x20
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x4c]
add al, 0x1d
xor al, 0x64
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x4c]
add al, 0x1e
xor al, 0x6f
mov byte [ebp - 0x2a], al
mov eax, dword [ebp - 0x4c]
add al, 0x1f
xor al, 0x73
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 0x4c]
add al, 0x20
xor al, 0x79
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x4c]
add al, 0x21
xor al, 0x61
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x4c]
add al, 0x22
xor al, 0x73
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x4c]
add al, 0x23
xor al, 0xfd
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x4c]
add al, 0x24
xor al, 0x6e
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x4c]
add al, 0x25
xor al, 0xfd
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 0x4c]
add al, 0x26
xor al, 0x6e
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 0x4c]
add al, 0x27
xor al, 0x20
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x4c]
add al, 0x28
xor al, 0x61
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x4c]
add al, 0x29
xor al, 0x64
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x4c]
add al, 0x2a
xor al, 0xfd
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x4c]
add al, 0x2b
xor al, 0x6e
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x4c]
add al, 0x2c
xor al, 0xfd
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x4c]
add al, 0x2d
xor al, 0x20
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x4c]
add al, 0x2e
xor al, 0x64
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x4c]
add al, 0x2f
xor al, 0x65
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x4c]
add al, 0x30
xor al, 0xf0
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x4c]
add al, 0x31
xor al, 0x69
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x4c]
add al, 0x32
xor al, 0xfe
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x4c]
add al, 0x33
xor al, 0x74
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x4c]
add al, 0x34
xor al, 0x69
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x4c]
add al, 0x35
xor al, 0x72
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x4c]
add al, 0x36
xor al, 0x65
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x4c]
add al, 0x37
xor al, 0x6d
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x4c]
add al, 0x38
xor al, 0x65
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x4c]
add al, 0x39
xor al, 0x7a
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x4c]
add al, 0x3a
xor al, 0x73
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x4c]
add al, 0x3b
xor al, 0x69
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x4c]
add al, 0x3c
xor al, 0x6e
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x4c]
add al, 0x3d
xor al, 0x69
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x4c]
add al, 0x3e
xor al, 0x7a
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x4c]
add al, 0x3f
mov byte [ebp - 8], 0
xor al, 0x2e
mov byte [ebp - 9], al
mov al, byte [ebp - 0x48]
xor eax, eax
mov cl, byte [ebp + eax - 0x48]
mov edx, dword [ebp - 0x4c]
add dl, al
xor dl, cl
mov byte [ebp + eax - 0x48], dl
inc eax
cmp eax, 0x40
jb 0x10025373
lea eax, [ebp - 0x48]
mov byte [ebp - 8], 0
push eax
push 0xff6961
call fcn.10008ff0
add esp, 8
mov al, 1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100608cb
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100bc340], eax
mov eax, 0x10027ef0
add eax, 0x275
mov dword [0x1018a7a0], 1
push 0x275
push eax
mov dword [0x1018a8c4], 0
call fcn.1000d330
mov eax, 0x1003fd60
add eax, 0x160
push 0x160
push eax
call fcn.1000d330
add esp, 0x10
push 0
push 0
push 0
push 0x1004e4f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 0x100275f0
add eax, 0x205
push 0x205
push eax
call fcn.1000d330
mov eax, 0x10026640
add eax, 0x285
push 0x285
push eax
call fcn.1000d330
mov eax, 0x10025510
add eax, 0x190
push 0x190
push eax
call fcn.1000d330
add esp, 0x18
push 0
push 0
push 0
push 0x100283a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1002547b
cmp byte [0x1018a8bc], 0
jne 0x1002547b
mov byte [0x1018a8bc], 1
push dword [ebp + 0x1c]
mov eax, dword [0x1018e398]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push ebx
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x64]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100608cb
mov esp, ebp
pop ebp
ret 0x18