Function at 0x10014860
Capabilities:
Check for foreground window switch
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ce26
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 4], 0
call fcn.100121e0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
mov dword [ebp - 0x14c], eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x13c], eax
lea edi, [ebx + 0x84]
mov byte [ebp - 4], 1
mov eax, dword [edi]
mov esi, 1
mov ecx, esi
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x40
or eax, ecx
mov dword [ebp - 0x130], edi
jge 0x100148f4
push 0x40
mov ecx, edi
call fcn.10008240
mov ecx, dword [edi]
lea edx, [ebp - 0x13c]
call fcn.10016a90
mov ecx, dword [ebx + 0x84]
lea edx, [ebx + 0x84]
mov edi, eax
test ecx, ecx
je 0x1001492f
push dword [ecx - 8]
push ecx
call fcn.1004cc03
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100150b1
lea edx, [ebx + 0x84]
mov eax, dword [edx]
cmp ecx, dword [eax - 8]
jg 0x100150b1
push dword [ebp - 0x14c]
mov dword [eax - 0xc], ecx
mov eax, dword [edx]
mov byte [ecx + eax], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
sete byte [ebp - 0x131]
call fcn.10015bb0
mov ecx, ebx
call fcn.100150c0
test edi, edi
je 0x1001504c
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x15c]
push eax
push dword [ebx + 0x48]
xor edi, edi
push dword [ebx + 0x44]
mov dword [ebp - 0x154], edi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x144], 4
call dword [0x100a0610]
test eax, eax
jne 0x100149b7
cmp dword [ebp - 0x140], edi
cmove edi, esi
mov dword [ebp - 0x154], edi
mov dword [ebp - 0x140], esi
mov esi, dword [ebx + 0x48]
push 1
push ecx
mov dword [ebp - 0x144], 4
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x138], esp
mov eax, dword [ecx]
mov dword [ebp - 0x12c], esp
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x100149ff
cmp ecx, dword [esi - 0x10]
jne 0x100149ff
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014a2c
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10014a13
call fcn.10008235
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [esi - 0xc]
inc ecx
push ecx
push esi
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov byte [ebp - 4], 2
mov esi, dword [ebx + 0x44]
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x12c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x10014a6b
cmp ecx, dword [esi - 0x10]
jne 0x10014a6b
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014a98
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10014a7f
call fcn.10008235
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [esi - 0xc]
inc ecx
push ecx
push esi
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.10016170
mov eax, dword [0x1009d2a8]
push 1
push ecx
mov edi, esp
mov ecx, 0x1009d2a8
mov dword [ebp - 0x144], 4
mov dword [ebp - 0x140], 1
mov word [ebp - 0x15], 0x766f
mov word [ebp - 0x12], 0x72
mov word [ebp - 0x1b], 0x7475
mov byte [ebp - 0x13], 0x65
mov word [ebp - 0x18], 0x6552
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x19], 0x6f
mov dword [ebp - 0x138], esp
mov dword [ebp - 0x12c], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x10014b34
movzx esi, ax
mov ecx, esi
call fcn.100017b9
test eax, eax
je 0x10014b55
push esi
push eax
mov ecx, edi
call fcn.10007221
jmp 0x10014b55
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014b40
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.100081be
mov byte [ebp - 4], 4
mov esi, dword [ebx + 0x8c]
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x12c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x10014b8c
cmp ecx, dword [esi - 0x10]
jne 0x10014b8c
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014bb9
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10014ba0
call fcn.10008235
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [esi - 0xc]
inc ecx
push ecx
push esi
push ecx
lea eax, [edi + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.10016170
mov esi, dword [ebp - 0x13c]
push esi
call dword [0x100a05e4]
test eax, eax
jne 0x10014c4a
push 0x103
push eax
mov byte [ebp - 0x128], al
lea eax, [ebp - 0x127]
push eax
call fcn.1004e5f0
mov eax, dword [0x100a05ec]
add esp, 0xc
test eax, eax
je 0x10014c16
push 0
push 0x26
lea ecx, [ebp - 0x128]
push ecx
push 0
call eax
add esp, 0x10
push dword [ebx + 0x90]
lea eax, [ebp - 0x128]
push eax
call dword [0x100a05e8]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x13c]
push 0x10092414
push eax
call fcn.10009163
mov esi, dword [ebp - 0x13c]
add esp, 0x14
mov edi, dword [ebx + 0x84]
sub esp, 8
mov ecx, dword [edi - 0x10]
mov dword [ebp - 0x138], 0
mov eax, dword [ecx]
mov dword [ebp - 0x158], esp
mov dword [ebp - 0x12c], esp
call dword [eax + 0x10]
cmp dword [edi - 4], 0
lea edx, [edi - 4]
mov ecx, eax
jl 0x10014c8f
cmp ecx, dword [edi - 0x10]
jne 0x10014c8f
lea ebx, [edi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014cbc
mov eax, dword [ecx]
push 1
push dword [edi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10014ca3
call fcn.10008235
mov eax, dword [edi - 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [edi - 0xc]
inc ecx
push ecx
push edi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 5
mov eax, dword [0x1009d2a8]
mov edi, esp
mov ecx, 0x1009d2a8
mov dword [ebp - 0x150], esp
mov dword [ebp - 0x12c], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x1009231d
mov byte [ebp - 4], 6
test eax, 0xffff0000
jne 0x10014d15
movzx ebx, ax
mov ecx, ebx
call fcn.100017b9
test eax, eax
je 0x10014d23
push ebx
push eax
mov ecx, edi
call fcn.10007221
jmp 0x10014d23
push 0
push 0x1009231d
mov ecx, edi
call fcn.100081be
mov byte [ebp - 4], 7
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x12c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x10014d54
cmp ecx, dword [esi - 0x10]
jne 0x10014d54
lea ebx, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014d81
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10014d68
call fcn.10008235
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [esi - 0xc]
inc ecx
push ecx
push esi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.10017350
add esp, 0x10
test eax, eax
jne 0x10014ec6
mov eax, dword [ebp - 0x130]
sub esp, 8
mov ebx, dword [eax]
sub ebx, 0x10
mov dword [ebp - 0x150], esp
mov ecx, dword [ebx]
mov dword [ebp - 0x12c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x10014de7
cmp ecx, dword [ebx]
jne 0x10014de7
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014e23
mov eax, dword [ecx]
push 1
push dword [ebx + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x130], edx
test edx, edx
jne 0x10014e01
call fcn.10008235
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebx + 4]
inc ecx
push ecx
lea eax, [ebx + 0x10]
push eax
push ecx
lea eax, [edx + 0x10]
push eax
call fcn.1004d8fb
mov ebx, dword [ebp - 0x130]
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x158], esp
push 0x1009231d
call fcn.1000608b
mov byte [ebp - 4], 9
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x130], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x10014e76
cmp ecx, dword [esi - 0x10]
jne 0x10014e76
lea ebx, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014ea3
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10014e8a
call fcn.10008235
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [esi - 0xc]
inc ecx
push ecx
push esi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x130]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.10017000
add esp, 0x10
cmp byte [ebp - 0x131], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x10014f2a
xor edi, edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x12c]
je 0x10014f18
push 0x64
call ebx
inc edi
cmp edi, 0x12c
jl 0x10014ed7
jmp 0x10014f2a
push 0x3e8
call ebx
mov ecx, dword [ebp - 0x14c]
call fcn.10010c50
cmp dword [ebp - 0x154], 0
je 0x10015052
push 0x9c4
call ebx
mov edi, dword [ebp - 0x148]
push 0
mov edi, dword [edi + 0x48]
push ecx
mov dword [ebp - 0x144], 4
mov dword [ebp - 0x140], 0
mov ecx, dword [edi - 0x10]
mov dword [ebp - 0x150], esp
mov eax, dword [ecx]
mov dword [ebp - 0x130], esp
call dword [eax + 0x10]
cmp dword [edi - 4], 0
lea edx, [edi - 4]
mov ecx, eax
jl 0x10014f90
cmp ecx, dword [edi - 0x10]
jne 0x10014f90
lea ebx, [edi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10014fbd
mov eax, dword [ecx]
push 1
push dword [edi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10014fa4
call fcn.10008235
mov eax, dword [edi - 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [edi - 0xc]
inc ecx
push ecx
push edi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov ecx, dword [ebp - 0x130]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x148]
mov byte [ebp - 4], 0xa
mov edi, dword [eax + 0x44]
push ecx
mov ecx, dword [edi - 0x10]
mov dword [ebp - 0x130], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi - 4], 0
mov ecx, eax
lea eax, [edi - 4]
jl 0x10015003
cmp ecx, dword [edi - 0x10]
jne 0x10015003
lea ebx, [edi - 0x10]
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jmp 0x10015030
mov eax, dword [ecx]
push 1
push dword [edi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10015017
call fcn.10008235
mov eax, dword [edi - 0xc]
mov dword [ebx + 4], eax
mov ecx, dword [edi - 0xc]
inc ecx
push ecx
push edi
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.1004d8fb
add esp, 0x10
mov edx, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x148]
lea eax, [ebx + 0x10]
mov dword [edx], eax
mov byte [ebp - 4], 1
call fcn.10016170
jmp 0x10015052
mov esi, dword [ebp - 0x13c]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10015072
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10015093
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004bbda
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100016d9
int3