Function at 0x2431f10
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x24bfc9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push ebp
push esi
mov ebp, edx
mov esi, ecx
mov cl, 0x8e
mov al, 0xc6
mov bl, 0xf
mov dl, 0xae
push edi
mov byte [esp + 0x1c], 0xe9
mov byte [esp + 0x1d], 0xa8
mov byte [esp + 0x1e], 0x57
mov byte [esp + 0x1f], 0x46
mov byte [esp + 0x20], 0xeb
mov byte [esp + 0x21], pe_nt_image_headers32
mov byte [esp + 0x22], 0xfa
mov byte [esp + 0x23], 0xd7
mov byte [esp + 0x24], 0x8b
mov byte [esp + 0x25], 0xf4
mov byte [esp + 0x26], 0x21
mov byte [esp + 0x27], 0xab
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x15
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], 0xb6
mov byte [esp + 0x2e], 0x2b
mov byte [esp + 0x2f], 0x9d
mov byte [esp + 0x30], 0x18
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0xa5
mov byte [esp + 0x33], 0x9f
mov byte [esp + 0x34], 0x5d
mov byte [esp + 0x35], 0xf7
mov byte [esp + 0x36], 0x90
mov byte [esp + 0x37], 9
mov byte [esp + 0x38], 0x51
mov byte [esp + 0x39], 0xb8
mov byte [esp + 0x3a], 0xee
mov byte [esp + 0x3b], 0x7e
mov byte [esp + 0x3c], 0xc3
mov byte [esp + 0x3d], 0xb5
mov byte [esp + 0x3e], 0x35
mov byte [esp + 0x3f], 7
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0x9e
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], 0xea
mov byte [esp + 0x45], 0x41
mov byte [esp + 0x46], 0x1c
mov byte [esp + 0x47], 0xef
mov byte [esp + 0x48], 0x9f
mov byte [esp + 0x49], 0x3e
mov byte [esp + 0x4a], 0xa8
mov byte [esp + 0x4b], 0xa0
mov byte [esp + 0x4c], 0xe4
mov byte [esp + 0x4d], 0x44
mov byte [esp + 0x4e], 0xdf
mov byte [esp + 0x4f], 0x2e
mov byte [esp + 0x50], 0x4b
mov byte [esp + 0x51], 0x97
mov byte [esp + 0x52], 0x66
mov byte [esp + 0x53], cl
mov byte [esp + 0x54], 0x10
mov byte [esp + 0x55], 0xc0
mov byte [esp + 0x56], 0x75
mov byte [esp + 0x57], 0xb2
mov byte [esp + 0x58], 0xbf
mov byte [esp + 0x59], 0x6f
mov byte [esp + 0x5a], 0x63
mov byte [esp + 0x5b], al
mov byte [esp + 0x5c], 0x5a
mov byte [esp + 0x5d], 0xe0
mov byte [esp + 0x5e], 0x98
mov byte [esp + 0x5f], 0xd
mov byte [esp + 0x60], 0xf4
mov byte [esp + 0x61], 0x14
mov byte [esp + 0x62], 0xe8
mov bl, 0x11
mov byte [esp + 0x66], dl
mov dl, 0x58
mov byte [esp + 0x69], bl
mov byte [esp + 0x6b], bl
mov bl, 0x65
mov byte [esp + 0x71], cl
mov cl, 0x47
mov byte [esp + 0x67], dl
mov byte [esp + 0x70], bl
mov byte [esp + 0x74], dl
mov dl, 0x45
mov byte [esp + 0x84], al
mov byte [esp + 0x86], bl
mov al, 0xda
mov byte [esp + 0x82], cl
mov byte [esp + 0x94], cl
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x63], 9
mov byte [esp + 0x64], 0x70
mov byte [esp + 0x65], 0xb3
mov byte [esp + 0x68], 0xe1
mov byte [esp + 0x6a], 0x95
mov byte [esp + 0x6c], 0x91
mov byte [esp + 0x6d], 0xe2
mov byte [esp + 0x6e], 0x69
mov byte [esp + 0x6f], 0x68
mov byte [esp + 0x72], 0x3d
mov byte [esp + 0x73], 0x5a
mov byte [esp + 0x75], 0xdb
mov byte [esp + 0x76], 0x41
mov byte [esp + 0x77], 0xef
mov byte [esp + 0x78], 0x90
mov byte [esp + 0x79], 0xee
mov byte [esp + 0x7a], 3
mov byte [esp + 0x7b], 6
mov byte [esp + 0x7c], 0x28
mov byte [esp + 0x7d], 0xaa
mov byte [esp + 0x7e], 0x5b
mov byte [esp + 0x7f], 0xfd
mov byte [esp + 0x80], 0x6c
mov byte [esp + 0x81], dl
mov byte [esp + 0x83], 0x72
mov byte [esp + 0x85], 0xed
mov byte [esp + 0x87], 0x46
mov byte [esp + 0x88], 0x4c
mov byte [esp + 0x89], 0xe4
mov byte [esp + 0x8a], 0x61
mov byte [esp + 0x8b], 0x1c
mov byte [esp + 0x8c], 0xc7
mov byte [esp + 0x8d], 0x20
mov byte [esp + 0x8e], 0x7e
mov byte [esp + 0x8f], 0xd4
mov byte [esp + 0x90], 0x40
mov byte [esp + 0x91], 0xe0
mov byte [esp + 0x92], 0x9c
mov byte [esp + 0x93], 0x69
mov byte [esp + 0x95], al
mov byte [esp + 0x96], 0xb5
mov byte [esp + 0x97], 0x22
mov byte [esp + 0x98], dl
mov byte [esp + 0x99], al
mov byte [esp + 0x9a], 0x63
mov byte [esp + 0x9b], 0xc9
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 1
call fcn.0247c320
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xa0]
push ecx
push 1
mov edx, 0xc8
mov ecx, esi
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.0248f8e0
test eax, eax
jne 0x2432270
lea ecx, [esp + 0x10]
mov dword [esp + 0xac], 0xffffffff
call fcn.0247bca0
xor eax, eax
jmp 0x2432315
mov edx, dword [esp + 0x9c]
mov edi, dword [esp + 0xa0]
add esi, edx
cmp esi, ebx
je 0x2432255
cmp edi, ebx
je 0x2432255
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x24322a1
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x14], ebx
push edi
call fcn.024acf00
add esp, 4
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x2432255
mov dword [esp + 0x10], edi
mov ecx, edi
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xb4]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
push 3
lea edx, [esp + 0x38]
push edx
push 0x80
lea edx, [esp + 0x44]
lea ecx, [esp + 0x38]
call fcn.0247b1a0
test eax, eax
mov dword [esp + 0xac], 0xffffffff
lea ecx, [esp + 0x10]
jne 0x243230b
call fcn.0247bca0
xor eax, eax
jmp 0x2432315
call fcn.0247bca0
mov eax, 1
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa0
ret 4