Function at 0x10024570
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10077fec], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x100247ec
call fcn.10024480
mov eax, dword [0x10076fa4]
mov ebx, fcn.10007900
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x100245df
cmp ebx, 0x1000
jbe 0x100245df
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10024614
cmp ebx, 0x1000
jbe 0x10024614
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x48]
cmp esi, 0x1000
jbe 0x10024649
cmp ebx, 0x1000
jbe 0x10024649
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002467e
cmp ebx, 0x1000
jbe 0x1002467e
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x50]
cmp esi, 0x1000
jbe 0x100246b3
cmp ebx, 0x1000
jbe 0x100246b3
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x100246e8
cmp ebx, 0x1000
jbe 0x100246e8
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x10076fa4]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10024718
cmp ebx, 0x1000
jbe 0x10024718
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10007900
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x10078b88], 0
jne 0x10024773
mov ecx, dword [0x100769d4]
push 0x100775f4
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
cmp esi, 0x1000
jbe 0x1002476b
mov eax, 0x10024310
cmp eax, 0x1000
jbe 0x1002476b
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10024310
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x1002476d
xor ebx, ebx
mov dword [0x10078b88], ebx
cmp dword [0x10076dc8], 0
jne 0x100247df
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x100247d8
push 0xc
call fcn.1004e86f
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x100247da
xor eax, eax
mov dword [0x10076dc8], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x10077fec], 1
call fcn.1001cdf0
mov ecx, dword [0x10076e18]
test ecx, ecx
jne 0x10024807
mov dword [0x10076734], 0x32
jmp 0x1002483b
cmp ecx, 1
jne 0x10024818
mov dword [0x10076734], 6
jmp 0x1002483b
cmp ecx, 2
jne 0x10024829
mov dword [0x10076734], 5
jmp 0x1002483b
mov eax, dword [0x10076734]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10076734], eax
call fcn.1001ad00
call fcn.1001ac60
mov ecx, ebx
call fcn.1001ae70
call fcn.100222f0
mov ecx, ebx
call fcn.1001caa0
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024913
cmp dword [0x1007654c], 0
jne 0x100248d8
cmp dword [0x100730e8], 0
jne 0x100248d8
cmp dword [0x10078434], 0
jne 0x100248d8
cmp dword [0x100776d4], 0
jne 0x100248d8
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024951
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100658c8]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1002494c
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024951
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100658c4]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x1002494c
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024951
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100658c8]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100249ae
cmp dword [0x10076ddc], 0
jne 0x1002497c
cmp dword [0x1007769c], 0
je 0x100249ae
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100249ec
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100658c4]
jmp 0x100249de
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100249ec
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10065924]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.1001f6c0
mov ecx, ebx
call fcn.1001e430
mov ecx, ebx
call fcn.1001ef50
mov ecx, ebx
call fcn.1001e9b0
call fcn.1001ebf0
call fcn.1001ecf0
call fcn.100216c0
call fcn.10021a60
call fcn.10021d90
call fcn.100215b0
call fcn.10022600
cmp dword [0x10076580], 0
je 0x10024adb
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024adb
push 0x20
mov dword [0x100770a4], 0x10012790
call fcn.10012790
cwde
shr eax, 0x10
test eax, eax
je 0x10024ad4
cmp byte [0x10078ea0], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10024a93
cmp dword [0x10078ea4], 0
je 0x10024adb
call esi
mov ecx, dword [0x10078ea4]
inc ecx
cmp ecx, eax
ja 0x10024adb
mov byte [0x10078ea0], 1
call esi
mov ecx, dword [0x100769d4]
mov dword [0x10078ea4], eax
mov eax, dword [0x10073144]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10024b1a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10065928]
jmp 0x10024b0c
mov byte [0x10078ea0], 0
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10024b1a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006592c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10021f00
call fcn.10021fb0
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x168
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10024bc9
cmp dword [0x10078400], 1
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
mov edx, dword [ecx]
jne 0x10024b97
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100769d4]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10073144]
je 0x10024b97
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10024bc9
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006594c]
jmp 0x10024bbb
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10024bc9
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10065950]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10022a10
call fcn.1001fe50
call fcn.1001fd80
cmp dword [0x1007697c], 0
jle 0x10024c77
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024c77
mov eax, dword [0x1007697c]
cmp eax, 1
jne 0x10024c14
mov dword [0x10078cb0], 0x42c80000
jmp 0x10024c45
cmp eax, 2
jne 0x10024c25
mov dword [0x10078cb0], 0x42dc0000
jmp 0x10024c45
cmp eax, 3
jne 0x10024c36
mov dword [0x10078cb0], 0x42f00000
jmp 0x10024c45
cmp eax, 4
jne 0x10024c45
mov dword [0x10078cb0], 0x42fa0000
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024cb5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100658c4]
jmp 0x10024ca7
mov ecx, dword [0x100769d4]
mov eax, dword [0x10073144]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024cb5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10065920]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10022860
call fcn.1001edf0
call fcn.10022950
call fcn.10022430
call fcn.10022120
call fcn.100221c0
call fcn.100236a0
call fcn.100233b0
call fcn.100238f0
mov ecx, ebx
call fcn.10023730
call fcn.10022b50
call fcn.10023290
call fcn.10022f30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004df39
mov esp, ebp
pop ebp
ret