Function at 0x10024d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100929fc]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100929fc], eax
call fcn.1001c3f0
mov ecx, dword [0x10091818]
test ecx, ecx
jne 0x10024d94
mov dword [0x1009112c], 0x32
jmp 0x10024dc8
cmp ecx, 1
jne 0x10024da5
mov dword [0x1009112c], 6
jmp 0x10024dc8
cmp ecx, 2
jne 0x10024db6
mov dword [0x1009112c], 5
jmp 0x10024dc8
mov eax, dword [0x1009112c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1009112c], eax
call fcn.10011b80
test eax, eax
je 0x10024e2a
push 0x75
mov dword [0x10091aac], 0x10011e90
call fcn.10011e90
cwde
shr eax, 0x10
test eax, eax
je 0x10024e23
cmp byte [0x10093598], 0
je 0x10024e0a
cmp dword [0x1009359c], 0
je 0x10024e2a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009359c], eax
ja 0x10024e2a
xor eax, eax
mov byte [0x10093598], 1
cmp dword [0x10090f40], eax
sete al
mov dword [0x10090f40], eax
jmp 0x10024e2a
mov byte [0x10093598], 0
call fcn.1001a2f0
call fcn.1001a020
mov ecx, ebx
call fcn.1001a470
call fcn.100226b0
mov ecx, ebx
call fcn.1001c0a0
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x10024efd
cmp dword [0x10090f44], 0
jne 0x10024ec6
cmp dword [0x1008d708], 0
jne 0x10024ec6
cmp dword [0x10092e44], 0
jne 0x10024ec6
cmp dword [0x100920dc], 0
jne 0x10024ec6
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10024f37
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10024f2f
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10024f37
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10024f32
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10024f37
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024f92
cmp dword [0x100917d4], 0
jne 0x10024f62
cmp dword [0x100920a4], 0
je 0x10024f92
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10024fcc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10024fc0
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10024fcc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.1001fae0
mov ecx, ebx
call fcn.1001e9e0
mov ecx, ebx
call fcn.1001f4d0
mov ecx, ebx
call fcn.1001ef30
call fcn.1001f170
call fcn.1001f270
call fcn.10021a80
call fcn.10021e20
call fcn.10022150
call fcn.10021970
call fcn.10022940
cmp dword [0x10090f78], 0
je 0x100250c1
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100250c1
push 0x20
mov dword [0x10091aac], 0x10011e90
call fcn.10011e90
cwde
shr eax, 0x10
test eax, eax
je 0x100250ba
cmp byte [0x100932f0], 0
je 0x10025075
cmp dword [0x100932f4], 0
je 0x100250c1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100932f4]
inc ecx
cmp ecx, eax
ja 0x100250c1
jmp 0x1002507b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100932f0], 1
call edi
mov ecx, dword [0x100913cc]
mov dword [0x100932f4], eax
mov eax, dword [0x1008d760]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100250fc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x100250f0
mov byte [0x100932f0], 0
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100250fc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100222c0
call fcn.10022370
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x168
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x100251a5
cmp dword [0x10092e10], 1
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
mov edx, dword [ecx]
jne 0x10025177
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100913cc]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x1008d760]
je 0x10025177
add eax, 0x168
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x100251a5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x10025199
add eax, 0x168
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x100251a5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10022d50
call fcn.10020210
call fcn.10020140
cmp dword [0x10091374], 0
jle 0x10025206
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10025206
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025240
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10025234
mov ecx, dword [0x100913cc]
mov eax, dword [0x1008d760]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025240
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10022ba0
call fcn.1001f370
call fcn.10022c90
call fcn.100227f0
call fcn.100224e0
call fcn.10022580
call fcn.10023a10
call fcn.10023720
call fcn.10023c60
mov ecx, ebx
call fcn.10023aa0
call fcn.10022ea0
call fcn.10023600
call fcn.10023290
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f4e9
mov esp, ebp
pop ebp
ret