Function at 0x10024e1b
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
jae 0x10024d16
jmp 0x10024d11
call fcn.10024d18
jae 0x10024d11
add esp, 4
jmp 0x10024d1d
dec dword [esp]
jno 0x10024d22
jns 0x10024d0d
jp 0x10024d26
add esp, 4
popf
jmp 0x10024d2d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10024d46
jne 0x10024d46
call 0x1fc2809a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
push 0x104
push 0
lea eax, [ebp - 0x17c]
push eax
call fcn.10029440
add esp, 0xc
xor eax, eax
test eax, eax
je 0x10024d8b
jne 0x10024d8a
call 0x93063e12
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov ebx, 0x73f8fb74
add bl, byte [edx - 0x45]
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10024d99
jmp 0x10024d9b
je 0x10024d96
clc
jae 0x10024da0
pop edx
mov ebx, 0x1750374
je 0x10024da5
jne 0x10024da5
mov ebx, 0xa6a9c66
pushf
push 0xa
jae 0x10024db2
jmp 0x10024dad
call 0x10024db4
jae 0x10024dad
add esp, 4
jmp 0x10024db9
dec dword [esp]
jno 0x10024dbe
jns 0x10024da9
jp 0x10024dc2
add esp, 4
popf
jmp 0x10024dc9
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10024de2
jne 0x10024de2
call 0x1fc28136
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov ecx, 0x100613c0
call fcn.100255e0
mov ecx, 0x100613c8
call fcn.100255e0
clc
jae 0x10024e0c
push ecx
invalid
pushf
push 0xa
jae 0x10024e19
jmp 0x10024e14
call 0x10024e1b
jae 0x10024e14
add esp, 4
jmp 0x10024e20
dec dword [esp]
jno 0x10024e25
jns 0x10024e10
jp 0x10024e29
add esp, 4
popf
jmp 0x10024e30
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10024e49
jne 0x10024e49
invalid
jl 0x10024e4e
jmp 0x10024e50
je 0x10024e4b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10024e6a
jne 0x10024e69
call 0x93063ef1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10024e78
jne 0x10024e78
call 0x106c4ee6
push 0
push 0
mov ecx, dword [ebp - 0x48]
push ecx
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x44], eax
je 0x10024eb3
jmp 0x10024f8f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x60], eax
jne 0x10024ec3
jmp 0x10024f8f
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10024ed6
jmp 0x10024f8f
push 0xfffffffffffffffc
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x10024f32
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x100613b4
call fcn.10025590
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, 0x100613b4
call fcn.10025530
mov ecx, eax
call fcn.10025430
movzx eax, al
test eax, eax
je 0x10024f32
lea ecx, [ebp - 0x48]
push ecx
mov ecx, 0x100613b4
call fcn.10025450
cmp dword [eax], 0x10024a10
jne 0x10024f32
jmp 0x10024f8f
cmp dword [ebp - 0x54], 0
je 0x10024f80
cmp dword [ebp - 0x54], 0x10024a10
je 0x10024f80
push 0x10024a10
push 0xfffffffffffffffc
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x70]
call fcn.10025650
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x100613b4
call fcn.10025670
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
push 0xfffffffffffffffc
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x48], 0
jne 0x10024e78
movzx eax, byte [0x1005faf0]
test eax, eax
jne 0x1002512f
mov ecx, 0x100613b4
call fcn.10025580
movzx ecx, al
test ecx, ecx
je 0x1002512f
cmp dword [ebp - 0x50], 3
jle 0x1002512f
mov byte [ebp - 0x40], 0x46
mov byte [ebp - 0x3f], 0x41
mov byte [ebp - 0x3e], 0x54
mov byte [ebp - 0x3d], 0x41
mov byte [ebp - 0x3c], 0x4c
mov byte [ebp - 0x3b], 0x20
mov byte [ebp - 0x3a], 0x45
mov byte [ebp - 0x39], 0x52
mov byte [ebp - 0x38], 0x52
mov byte [ebp - 0x37], 0x4f
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x21
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x41
mov byte [ebp - 0x32], 0x6e
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x69
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x68
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x75
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x6b
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x57
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0
lea ecx, [ebp - 0x40]
call fcn.100110e0
clc
jae 0x100250bc
add dword [ecx], esp
pushf
push 0xa
jae 0x100250c9
jmp 0x100250c4
call 0x100250cb
jae 0x100250c4
add esp, 4
jmp 0x100250d0
dec dword [esp]
jno 0x100250d5
jns 0x100250c0
jp 0x100250d9
add esp, 4
popf
jmp 0x100250e0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100250f9
jne 0x100250f9
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x100250fe
jmp 0x10025100
je 0x100250fb
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1002511a
jne 0x10025119
call 0x930641a1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10025128
jne 0x10025128
call 0xec09514
invalid
call fcn.10010f70
jmp 0x1002516a
movzx edx, byte [0x1005faf0]
test edx, edx
jne 0x1002516a
mov ecx, 0x100613b4
call fcn.10025580
movzx eax, al
test eax, eax
je 0x1002516a
cmp dword [ebp - 0x50], 3
jge 0x1002516a
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10024e07
movzx edx, byte [0x1005faf0]
test edx, edx
je 0x1002517c
mov byte [0x1005faf0], 0
cmp dword [ebp - 0x58], 1
jne 0x10025197
push 0
push 0
push 0
push 0x100231d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
clc
jae 0x1002519c
or esp, dword fs:[esi - 0x64]
pushf
push 0xa
jae 0x100251a9
jmp 0x100251a4
call 0x100251ab
jae 0x100251a4
add esp, 4
jmp 0x100251b0
dec dword [esp]
jno 0x100251b5
jns 0x100251a0
jp 0x100251b9
add esp, 4
popf
jmp 0x100251c0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100251d9
jne 0x100251d9
or edi, dword [ebx + eax - 0x15]
add ecx, dword [ebx]
jl 0x100251de
jmp 0x100251e0
je 0x100251db
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100251fa
jne 0x100251f9
call 0x93064281
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10025208
jne 0x10025208
call 0x9b5db06b
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret