Function at 0x1001d470
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1005b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1005d800], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, ecx
jne 0x1001d680
call fcn.1001d380
mov eax, dword [0x10062560]
lea esi, [eax + 0x40]
test esi, esi
je 0x1001d4cb
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x44]
test esi, esi
je 0x1001d4f4
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x48]
test esi, esi
je 0x1001d51d
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x4c]
test esi, esi
je 0x1001d546
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x50]
test esi, esi
je 0x1001d56f
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x54]
test esi, esi
je 0x1001d598
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x10062560]
lea esi, [eax + 0x58]
test esi, esi
je 0x1001d5bc
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10006d70
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x1005e388], 0
jne 0x1001d60a
mov ecx, dword [0x10061f94]
push 0x10062a9c
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
je 0x1001d603
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x1001d210
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
mov eax, dword [ebp - 0x48]
jmp 0x1001d605
xor eax, eax
mov dword [0x1005e388], eax
cmp dword [0x10062388], 0
jne 0x1001d676
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x1001d66f
push 0xc
call fcn.10040384
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx]
mov dword [esi], ecx
mov ax, word [edx + 4]
mov word [esi + 4], ax
mov al, byte [edx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub edx, eax
mov byte [eax], 0xe9
add edx, 2
mov dword [eax + 1], edx
add eax, 0xfffffff9
jmp 0x1001d671
xor eax, eax
mov dword [0x10062388], eax
mov dword [0x1005d800], 1
call fcn.100160a0
mov ecx, dword [0x100623d8]
test ecx, ecx
jne 0x1001d69b
mov dword [0x10061cf4], 0x32
jmp 0x1001d6cf
cmp ecx, 1
jne 0x1001d6ac
mov dword [0x10061cf4], 6
jmp 0x1001d6cf
cmp ecx, 2
jne 0x1001d6bd
mov dword [0x10061cf4], 5
jmp 0x1001d6cf
mov eax, dword [0x10061cf4]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10061cf4], eax
call fcn.10013e70
call fcn.10013dd0
mov ecx, ebx
call fcn.10013fe0
call fcn.1001b2c0
mov ecx, ebx
call fcn.10015d50
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d796
cmp dword [0x10061b0c], 0
jne 0x1001d75f
cmp dword [0x1005dc44], 0
jne 0x1001d75f
cmp dword [0x1005cee4], 0
jne 0x1001d75f
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d7d0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100527fc]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1001d7cb
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d7d0
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100527f8]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x1001d7cb
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d7d0
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100527fc]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d829
cmp dword [0x1006239c], 0
jne 0x1001d7fb
cmp dword [0x1005ceac], 0
je 0x1001d829
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d863
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100527f8]
jmp 0x1001d855
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d863
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10052850]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.10018810
mov ecx, ebx
call fcn.100176e0
mov ecx, ebx
call fcn.100181d0
mov ecx, ebx
call fcn.10017c60
call fcn.10017ea0
call fcn.10017f90
call fcn.1001a650
call fcn.1001a9f0
call fcn.1001ad20
call fcn.1001a540
call fcn.1001b550
cmp dword [0x10061b40], 0
je 0x1001d94e
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d94e
push 0x20
mov dword [0x10062660], 0x1000bc30
call fcn.1000bc30
cwde
shr eax, 0x10
test eax, eax
je 0x1001d947
cmp byte [0x10062e30], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x1001d90a
cmp dword [0x10062e34], 0
je 0x1001d94e
call esi
mov ecx, dword [0x10062e34]
inc ecx
cmp ecx, eax
ja 0x1001d94e
mov byte [0x10062e30], 1
call esi
mov ecx, dword [0x10061f94]
mov dword [0x10062e34], eax
mov eax, dword [0x1005e718]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
test esi, esi
je 0x1001d989
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10052854]
jmp 0x1001d97b
mov byte [0x10062e30], 0
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
test esi, esi
je 0x1001d989
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10052858]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.1001ae90
call fcn.1001af80
call fcn.1001b960
call fcn.10018de0
call fcn.10018d00
cmp dword [0x10061f3c], 0
jle 0x1001d9f2
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d9f2
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001da2c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100527f8]
jmp 0x1001da1e
mov ecx, dword [0x10061f94]
mov eax, dword [0x1005e718]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001da2c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005284c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.1001b7b0
call fcn.10018090
call fcn.1001b8a0
call fcn.1001b400
call fcn.1001b0f0
call fcn.1001b190
call fcn.1001c5b0
call fcn.1001c2c0
call fcn.1001c800
mov ecx, ebx
call fcn.1001c640
call fcn.1001baa0
call fcn.1001c1a0
call fcn.1001be60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003fb29
mov esp, ebp
pop ebp
ret