Function at 0x100152f0
Capabilities:
Check for foreground window switch
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081b36
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x100bb2a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.10012d10
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x150], eax
call fcn.10001e63
mov ecx, eax
test ecx, ecx
jne 0x10015353
push 0x80004005
call fcn.10001bd3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 1
lea edi, [ebx + 0x84]
mov eax, dword [edi]
mov ecx, 1
mov dword [ebp - 0x134], edi
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x40
or eax, ecx
jge 0x1001538e
push 0x40
mov ecx, edi
call fcn.10008e39
mov ecx, dword [edi]
lea edx, [ebp - 0x144]
call fcn.10017470
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100153b9
push dword [ecx - 8]
push ecx
call fcn.1005fea7
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x10015b59
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x10015b59
push dword [ebp - 0x150]
mov dword [eax - 0xc], ecx
mov eax, dword [edi]
mov byte [ecx + eax], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
sete byte [ebp - 0x139]
call fcn.10016590
mov ecx, ebx
call fcn.10015b70
test esi, esi
je 0x10015af8
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 4
push eax
lea eax, [ebp - 0x14c]
xor esi, esi
push eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x154], esi
push eax
push dword [ebx + 0x48]
push dword [ebx + 0x44]
push reloc.WS2_32.dll_accept
call dword [0x100bd9c0]
test eax, eax
jne 0x10015446
cmp dword [ebp - 0x14c], esi
mov eax, 1
cmove esi, eax
mov dword [ebp - 0x154], esi
push 1
push ecx
mov dword [ebp - 0x138], esp
mov eax, dword [ebx + 0x48]
lea esi, [eax - 0x10]
mov dword [ebp - 0x148], 4
mov dword [ebp - 0x14c], 1
mov ecx, dword [esi]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x10015490
cmp ecx, dword [esi]
jne 0x10015490
lock inc dword [eax]
jmp 0x100154c0
mov eax, dword [ecx]
lea edi, [esi + 4]
push 1
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x100154a6
call fcn.10008e8b
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [edi]
inc edx
push edx
push dword [ebp - 0x12c]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x138]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov byte [ebp - 4], 2
push ecx
mov dword [ebp - 0x138], esp
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x100154fe
cmp ecx, dword [esi]
jne 0x100154fe
lock inc dword [eax]
jmp 0x1001552e
mov eax, dword [ecx]
lea edi, [esi + 4]
push 1
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x10015514
call fcn.10008e8b
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [edi]
inc edx
push edx
push dword [ebp - 0x12c]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x138]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.10016b50
push 1
push ecx
mov esi, esp
mov dword [ebp - 0x148], 4
mov dword [ebp - 0x14c], 1
mov word [ebp - 0x19], 0x766f
mov word [ebp - 0x16], 0x72
mov word [ebp - 0x1f], 0x7475
mov byte [ebp - 0x17], 0x65
mov word [ebp - 0x1c], 0x6552
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x1d], 0x6f
mov dword [ebp - 0x130], esp
mov dword [ebp - 0x12c], esi
call fcn.10001e63
mov ecx, eax
test ecx, ecx
jne 0x100155a6
push 0x80004005
call fcn.10001bd3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x100155d7
movzx edi, ax
mov ecx, edi
call fcn.10001cf0
test eax, eax
je 0x100155f5
push edi
push eax
mov ecx, esi
call fcn.10007d68
jmp 0x100155f5
lea ecx, [ebp - 0x20]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100155e0
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
mov ecx, esi
call fcn.10008e96
mov byte [ebp - 4], 4
push ecx
mov dword [ebp - 0x138], esp
mov eax, dword [ebx + 0x8c]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x1001562b
cmp ecx, dword [esi]
jne 0x1001562b
lock inc dword [eax]
jmp 0x1001565b
mov eax, dword [ecx]
lea edi, [esi + 4]
push 1
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x10015641
call fcn.10008e8b
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov edx, dword [edi]
inc edx
push edx
push dword [ebp - 0x12c]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x138]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.10016b50
mov esi, dword [ebp - 0x144]
push esi
call dword [0x100bd9b4]
test eax, eax
jne 0x100156e6
push 0x104
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1005cd30
mov eax, dword [0x100bd9bc]
add esp, 0xc
test eax, eax
je 0x100156b2
push 0
push 0x26
lea ecx, [ebp - 0x128]
push ecx
push 0
call eax
add esp, 0x10
push dword [ebx + 0x90]
lea eax, [ebp - 0x128]
push eax
call dword [0x100bd9b8]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x144]
push 0x100a6b28
push eax
call fcn.100096bf
mov esi, dword [ebp - 0x144]
add esp, 0x14
sub esp, 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x130], esp
mov eax, dword [ebx + 0x84]
mov ecx, dword [eax - 0x10]
lea edi, [eax - 0x10]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x158], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x1001572a
cmp ecx, dword [edi]
jne 0x1001572a
lock inc dword [eax]
jmp 0x1001575a
mov eax, dword [ecx]
lea ebx, [edi + 4]
push 1
push dword [ebx]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10015740
call fcn.10008e8b
mov eax, dword [ebx]
lea ecx, [edi + 0x10]
mov dword [edi + 4], eax
mov edx, dword [ebx]
inc edx
push edx
push dword [ebp - 0x12c]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x130]
lea eax, [edi + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 5
mov edi, esp
mov dword [ebp - 0x12c], esp
mov dword [ebp - 0x130], edi
call fcn.10001e63
mov ecx, eax
test ecx, ecx
jne 0x1001578d
push 0x80004005
call fcn.10001bd3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x100a57dd
mov byte [ebp - 4], 6
test eax, 0xffff0000
jne 0x100157c0
movzx ebx, ax
mov ecx, ebx
call fcn.10001cf0
test eax, eax
je 0x100157ce
push ebx
push eax
mov ecx, edi
call fcn.10007d68
jmp 0x100157ce
push 0
push 0x100a57dd
mov ecx, edi
call fcn.10008e96
mov byte [ebp - 4], 7
push ecx
mov dword [ebp - 0x130], esp
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x100157f9
cmp ecx, dword [esi - 0x10]
jne 0x100157f9
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x10015824
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x1001580d
call fcn.10008e8b
mov eax, dword [esi - 0xc]
lea ecx, [ebx + 0x10]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x130]
lea eax, [ebx + 0x10]
lea edx, [ebp - 0x138]
mov dword [ecx], eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 1
call fcn.10017d80
add esp, 0x10
test eax, eax
jne 0x10015962
mov eax, dword [ebp - 0x134]
sub esp, 8
mov dword [ebp - 0x12c], esp
mov dword [ebp - 0x158], esp
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea ebx, [eax - 0x10]
mov dword [ebp - 0x130], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
mov ecx, eax
lea eax, [ebx + 0xc]
jl 0x1001588b
cmp ecx, dword [ebx]
jne 0x1001588b
lock inc dword [eax]
jmp 0x100158c7
mov eax, dword [ecx]
lea edx, [ebx + 4]
push 1
push dword [edx]
mov dword [ebp - 0x134], edx
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x100158a7
call fcn.10008e8b
mov ecx, dword [ebp - 0x134]
mov eax, dword [ecx]
mov dword [ebx + 4], eax
mov edx, dword [ecx]
lea ecx, [ebx + 0x10]
inc edx
push edx
push dword [ebp - 0x130]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x12c]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x130], esp
push 0x100a57dd
call fcn.10006677
mov byte [ebp - 4], 9
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x134], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x10015914
cmp ecx, dword [esi - 0x10]
jne 0x10015914
lea ebx, [esi - 0x10]
lock inc dword [eax]
jmp 0x1001593f
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x10015928
call fcn.10008e8b
mov eax, dword [esi - 0xc]
lea ecx, [ebx + 0x10]
mov dword [ebx + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
call fcn.100010b0
add esp, 8
mov edi, dword [ebp - 0x134]
lea eax, [ebx + 0x10]
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x130]
mov dword [edi], eax
mov byte [ebp - 4], 1
call fcn.10017a30
add esp, 0x10
cmp byte [ebp - 0x139], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x100159c6
xor edi, edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x12c]
je 0x100159b4
push 0x64
call ebx
inc edi
cmp edi, 0x12c
jl 0x10015973
jmp 0x100159c6
push 0x3e8
call ebx
mov ecx, dword [ebp - 0x150]
call fcn.100115d0
cmp dword [ebp - 0x154], 0
je 0x10015afe
push 0x9c4
call ebx
mov ebx, dword [ebp - 0x140]
push 0
push ecx
mov dword [ebp - 0x130], esp
mov eax, dword [ebx + 0x48]
lea edi, [eax - 0x10]
mov dword [ebp - 0x148], 4
mov dword [ebp - 0x14c], 0
mov ecx, dword [edi]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x158], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x10015a2a
cmp ecx, dword [edi]
jne 0x10015a2a
lock inc dword [eax]
jmp 0x10015a66
mov eax, dword [ecx]
lea edx, [edi + 4]
push 1
push dword [edx]
mov dword [ebp - 0x140], edx
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10015a46
call fcn.10008e8b
mov ecx, dword [ebp - 0x140]
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov edx, dword [ecx]
lea ecx, [edi + 0x10]
inc edx
push edx
push dword [ebp - 0x134]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x130]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov byte [ebp - 4], 0xa
push ecx
mov dword [ebp - 0x130], esp
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax - 0x10]
lea edi, [eax - 0x10]
mov dword [ebp - 0x134], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x10015aa4
cmp ecx, dword [edi]
jne 0x10015aa4
lock inc dword [eax]
jmp 0x10015ae0
mov eax, dword [ecx]
lea edx, [edi + 4]
push 1
push dword [edx]
mov dword [ebp - 0x140], edx
call dword [eax]
mov edi, eax
test edi, edi
jne 0x10015ac0
call fcn.10008e8b
mov ecx, dword [ebp - 0x140]
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov edx, dword [ecx]
lea ecx, [edi + 0x10]
inc edx
push edx
push dword [ebp - 0x134]
call fcn.100010b0
add esp, 8
mov ecx, dword [ebp - 0x130]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.10016b50
jmp 0x10015afe
mov esi, dword [ebp - 0x144]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015b1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10015b3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005a19b
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001bd3
int3