Function at 0x7024e6f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7030f9e3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x18], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 0
mov eax, dword [ecx + 0x20]
mov eax, dword [eax]
mov ebx, dword [ecx + 0xc]
mov edi, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
lea ecx, [ecx]
mov esi, dword [ecx + 0x20]
mov eax, dword [ecx + 0xc]
test ebx, ebx
je 0x7024e74e
cmp ebx, eax
je 0x7024e753
call fcn.702e2961
cmp edi, esi
je 0x7024e934
test ebx, ebx
jne 0x7024e7ab
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e770
call fcn.702e2961
mov ecx, dword [ebp + 8]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x7024e92a
mov eax, dword [edi + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x7024e7af
test dx, dx
je 0x7024e7a7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x7024e7af
add eax, 4
add ecx, 4
test dx, dx
jne 0x7024e785
xor eax, eax
jmp 0x7024e7b4
mov eax, dword [ebx]
jmp 0x7024e766
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x7024e900
test ebx, ebx
jne 0x7024e894
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e7da
call fcn.702e2961
cmp dword [edi + 0x14], 0
je 0x7024e900
test ebx, ebx
jne 0x7024e89b
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e7fd
call fcn.702e2961
cmp dword [edi + 0x24], 0
je 0x7024e900
test ebx, ebx
jne 0x7024e8a2
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e820
call fcn.702e2961
cmp dword [edi + 0x18], 0
je 0x7024e900
test ebx, ebx
jne 0x7024e8a9
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e83f
call fcn.702e2961
mov eax, dword [edi + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x7024e900
push 0xc
call fcn.702e1f8d
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov byte [esp + 0x30], 1
test esi, esi
je 0x7024e8ad
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + 8]
mov edi, dword [ebp + 0x10]
mov ebp, dword [ebp + 0xc]
sub eax, 0x10
call fcn.70208f30
add eax, 0x10
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x3c]
mov dword [esi + 8], edi
mov edi, dword [esp + 0x24]
mov dword [esi], eax
jmp 0x7024e8af
mov eax, dword [ebx]
jmp 0x7024e7d0
mov eax, dword [ebx]
jmp 0x7024e7f3
mov eax, dword [ebx]
jmp 0x7024e816
mov eax, dword [ebx]
jmp 0x7024e835
xor esi, esi
mov byte [esp + 0x30], 0
mov eax, dword [ebp + 0x14]
cmp eax, 1
jne 0x7024e8da
push esi
lea esi, [esp + 0x24]
call fcn.7028d060
mov edx, dword [eax + 0xc]
push edx
push 0x4ce
call fcn.7028d060
mov eax, dword [eax + 0x10]
push eax
jmp 0x7024e8fa
test eax, eax
jne 0x7024e900
push esi
lea esi, [esp + 0x24]
call fcn.7028d060
mov ecx, dword [eax + 0xc]
push ecx
push 0x4cb
call fcn.7028d060
mov edx, dword [eax + 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
test ebx, ebx
jne 0x7024e926
call fcn.702e2961
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x7024e915
call fcn.702e2961
mov eax, dword [edi]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov edi, eax
jmp 0x7024e740
mov eax, dword [ebx]
jmp 0x7024e90b
push 0x80004005
call fcn.702042c0
mov dword [esp + 0x30], 0xffffffff
test ebp, ebp
je 0x7024e968
mov eax, dword [ebp + 8]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x7024e95f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
call fcn.702e1c24
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8