Function at 0x10024220
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006e00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10071928], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x1002449c
call fcn.10024130
mov eax, dword [0x100708e0]
mov ebx, fcn.100078d0
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x1002428f
cmp ebx, 0x1000
jbe 0x1002428f
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x100242c4
cmp ebx, 0x1000
jbe 0x100242c4
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x48]
cmp esi, 0x1000
jbe 0x100242f9
cmp ebx, 0x1000
jbe 0x100242f9
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002432e
cmp ebx, 0x1000
jbe 0x1002432e
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x50]
cmp esi, 0x1000
jbe 0x10024363
cmp ebx, 0x1000
jbe 0x10024363
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10024398
cmp ebx, 0x1000
jbe 0x10024398
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x100708e0]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x100243c8
cmp ebx, 0x1000
jbe 0x100243c8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.100078d0
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x100724c0], 0
jne 0x10024423
mov ecx, dword [0x10070314]
push 0x10070e24
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
cmp esi, 0x1000
jbe 0x1002441b
mov eax, 0x10023fc0
cmp eax, 0x1000
jbe 0x1002441b
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10023fc0
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x1002441d
xor ebx, ebx
mov dword [0x100724c0], ebx
cmp dword [0x10070708], 0
jne 0x1002448f
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x10024488
push 0xc
call fcn.1004cb0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x1002448a
xor eax, eax
mov dword [0x10070708], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x10071928], 1
call fcn.1001cae0
mov ecx, dword [0x10070758]
test ecx, ecx
jne 0x100244b7
mov dword [0x10070074], 0x32
jmp 0x100244eb
cmp ecx, 1
jne 0x100244c8
mov dword [0x10070074], 6
jmp 0x100244eb
cmp ecx, 2
jne 0x100244d9
mov dword [0x10070074], 5
jmp 0x100244eb
mov eax, dword [0x10070074]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10070074], eax
call fcn.1001a9f0
call fcn.1001a950
mov ecx, ebx
call fcn.1001ab60
call fcn.10021fb0
mov ecx, ebx
call fcn.1001c790
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100245c3
cmp dword [0x10075c68], 0
jne 0x10024588
cmp dword [0x10072804], 0
jne 0x10024588
cmp dword [0x10071d6c], 0
jne 0x10024588
cmp dword [0x10071010], 0
jne 0x10024588
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024601
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063928]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x100245fc
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024601
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063924]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x100245fc
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10024601
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063928]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002465e
cmp dword [0x1007071c], 0
jne 0x1002462c
cmp dword [0x10070fd8], 0
je 0x1002465e
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x1002469c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063924]
jmp 0x1002468e
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x1002469c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006397c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.1001f390
mov ecx, ebx
call fcn.1001e120
mov ecx, ebx
call fcn.1001ec20
mov ecx, ebx
call fcn.1001e6a0
call fcn.1001e8e0
call fcn.1001e9e0
call fcn.10021380
call fcn.10021720
call fcn.10021a50
call fcn.10021270
call fcn.100222c0
cmp dword [0x10075c9c], 0
je 0x1002478b
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002478b
push 0x20
mov dword [0x100709e0], 0x10012660
call fcn.10012660
cwde
shr eax, 0x10
test eax, eax
je 0x10024784
cmp byte [0x10075e90], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10024743
cmp dword [0x10075e94], 0
je 0x1002478b
call esi
mov ecx, dword [0x10075e94]
inc ecx
cmp ecx, eax
ja 0x1002478b
mov byte [0x10075e90], 1
call esi
mov ecx, dword [0x10070314]
mov dword [0x10075e94], eax
mov eax, dword [0x10072860]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x100247ca
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063980]
jmp 0x100247bc
mov byte [0x10075e90], 0
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x100247ca
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063984]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10021bc0
call fcn.10021c70
call fcn.100226d0
call fcn.1001fb10
call fcn.1001fa50
cmp dword [0x100702bc], 0
jle 0x10024882
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10024882
mov eax, dword [0x100702bc]
cmp eax, 1
jne 0x1002481f
mov dword [0x100725e8], 0x42c80000
jmp 0x10024850
cmp eax, 2
jne 0x10024830
mov dword [0x100725e8], 0x42dc0000
jmp 0x10024850
cmp eax, 3
jne 0x10024841
mov dword [0x100725e8], 0x42f00000
jmp 0x10024850
cmp eax, 4
jne 0x10024850
mov dword [0x100725e8], 0x42fa0000
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100248c0
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063924]
jmp 0x100248b2
mov ecx, dword [0x10070314]
mov eax, dword [0x10072860]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100248c0
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063978]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10022520
call fcn.1001eae0
call fcn.10022610
call fcn.100220f0
call fcn.10021de0
call fcn.10021e80
call fcn.10023350
call fcn.10023060
call fcn.100235a0
mov ecx, ebx
call fcn.100233e0
call fcn.10022810
call fcn.10022f40
call fcn.10022be0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c1d9
mov esp, ebp
pop ebp
ret