Function at 0x10024790
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10076404], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x10024a0c
call fcn.100246a0
mov eax, dword [0x100753b4]
mov ebx, fcn.10007950
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x100247ff
cmp ebx, 0x1000
jbe 0x100247ff
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10024834
cmp ebx, 0x1000
jbe 0x10024834
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x48]
cmp esi, 0x1000
jbe 0x10024869
cmp ebx, 0x1000
jbe 0x10024869
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002489e
cmp ebx, 0x1000
jbe 0x1002489e
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x50]
cmp esi, 0x1000
jbe 0x100248d3
cmp ebx, 0x1000
jbe 0x100248d3
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10024908
cmp ebx, 0x1000
jbe 0x10024908
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10024938
cmp ebx, 0x1000
jbe 0x10024938
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x10076fa0], 0
jne 0x10024993
mov ecx, dword [0x10074de0]
push 0x100758fc
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
cmp esi, 0x1000
jbe 0x1002498b
mov eax, 0x10024530
cmp eax, 0x1000
jbe 0x1002498b
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10024530
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x1002498d
xor ebx, ebx
mov dword [0x10076fa0], ebx
cmp dword [0x100751d4], 0
jne 0x100249ff
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x100249f8
push 0xc
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x100249fa
xor eax, eax
mov dword [0x100751d4], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x10076404], 1
call fcn.1001d0e0
mov ecx, dword [0x10075224]
test ecx, ecx
jne 0x10024a27
mov dword [0x10074b40], 0x32
jmp 0x10024a5b
cmp ecx, 1
jne 0x10024a38
mov dword [0x10074b40], 6
jmp 0x10024a5b
cmp ecx, 2
jne 0x10024a49
mov dword [0x10074b40], 5
jmp 0x10024a5b
mov eax, dword [0x10074b40]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10074b40], eax
call fcn.1001aff0
call fcn.1001ad20
mov ecx, ebx
call fcn.1001b160
call fcn.100225e0
mov ecx, ebx
call fcn.1001cd90
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024b33
cmp dword [0x10074958], 0
jne 0x10024af8
cmp dword [0x1007110c], 0
jne 0x10024af8
cmp dword [0x1007684c], 0
jne 0x10024af8
cmp dword [0x10075aec], 0
jne 0x10024af8
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024b71
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064878]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10024b6c
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024b71
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064874]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x10024b6c
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024b71
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064878]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024bce
cmp dword [0x100751e8], 0
jne 0x10024b9c
cmp dword [0x10075ab4], 0
je 0x10024bce
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024c0c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064874]
jmp 0x10024bfe
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024c0c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006493c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.1001f9c0
mov ecx, ebx
call fcn.1001e720
mov ecx, ebx
call fcn.1001f250
mov ecx, ebx
call fcn.1001eca0
call fcn.1001eee0
call fcn.1001eff0
call fcn.100219b0
call fcn.10021d50
call fcn.10022080
call fcn.100218a0
call fcn.100228f0
cmp dword [0x1007498c], 0
je 0x10024cfb
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024cfb
push 0x20
mov dword [0x100754b8], 0x100127d0
call fcn.100127d0
cwde
shr eax, 0x10
test eax, eax
je 0x10024cf4
cmp byte [0x100772a0], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10024cb3
cmp dword [0x100772a4], 0
je 0x10024cfb
call esi
mov ecx, dword [0x100772a4]
inc ecx
cmp ecx, eax
ja 0x10024cfb
mov byte [0x100772a0], 1
call esi
mov ecx, dword [0x10074de0]
mov dword [0x100772a4], eax
mov eax, dword [0x10071168]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10024d3a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064940]
jmp 0x10024d2c
mov byte [0x100772a0], 0
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10024d3a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064944]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.100221f0
call fcn.100222a0
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x168
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10024de9
cmp dword [0x10076818], 1
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
mov edx, dword [ecx]
jne 0x10024db7
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x10074de0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10071168]
je 0x10024db7
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10024de9
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064964]
jmp 0x10024ddb
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10024de9
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064968]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10022d00
call fcn.10020140
call fcn.10020080
cmp dword [0x10074d88], 0
jle 0x10024e97
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024e97
mov eax, dword [0x10074d88]
cmp eax, 1
jne 0x10024e34
mov dword [0x10070ee4], 0x42c80000
jmp 0x10024e65
cmp eax, 2
jne 0x10024e45
mov dword [0x10070ee4], 0x42dc0000
jmp 0x10024e65
cmp eax, 3
jne 0x10024e56
mov dword [0x10070ee4], 0x42f00000
jmp 0x10024e65
cmp eax, 4
jne 0x10024e65
mov dword [0x10070ee4], 0x42fa0000
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024ed5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064874]
jmp 0x10024ec7
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024ed5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10064938]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10022b50
call fcn.1001f0f0
call fcn.10022c40
call fcn.10022720
call fcn.10022410
call fcn.100224b0
call fcn.100239a0
call fcn.100236b0
call fcn.10023bf0
mov ecx, ebx
call fcn.10023a30
call fcn.10022e50
call fcn.10023590
call fcn.10023230
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret