Function at 0x1000fc40
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100488b8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10062018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x10062018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor edi, edi
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + 0x1005d8a8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x30], dl
jns 0x1000fc9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x14
jl 0x1000fc80
mov byte [esp + 0x44], 0
mov dword [esp + 0x70], edi
mov ecx, 0x1f
xor eax, eax
mov dl, byte [eax + str.Vfira_nuINF_OY]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x48], dl
jns 0x1000fcd0
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x1000fcb3
mov byte [esp + 0x5f], 0
mov byte [esp + 0x70], 1
mov ecx, dword [0x10073cd4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [esp + 0x30]
push edx
call eax
mov esi, eax
push 4
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x1000fd50
lea ecx, [esp + 0x24]
push ecx
push 0x40
push 4
push esi
call edi
push eax
call ebx
lea edx, [esp + 0x2c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
push ecx
push edx
push 4
push esi
call edi
push eax
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [0x10073cd4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
push eax
call edx
mov esi, eax
add esi, dword [esp + 0x10]
xor eax, eax
push 4
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000fdc2
lea eax, [esp + 0x20]
push eax
push 0x40
push 4
push esi
call edi
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
push 4
push esi
call edi
push eax
call ebx
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [0x10073440], eax
mov dword [esp + 0x70], 0xffffffff
cmp eax, ebx
je 0x100101a3
call fcn.100074e0
push eax
call fcn.100073c0
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [0x10073794]
call fcn.100074e0
push eax
call fcn.10007450
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [0x10071718]
cmp dword [0x1007356c], ebx
je 0x1000fe63
call fcn.1000a770
call fcn.1000b6f0
cmp dword [0x100732e0], ebx
jne 0x1000fe5c
mov edx, dword [0x10074334]
mov eax, dword [0x10073440]
push 0x100732e0
add edx, 5
push eax
mov dword [0x10070cf8], edx
mov dword [0x10072180], 0x100097c0
call fcn.100097c0
call fcn.1000a7e0
jmp 0x1000fea7
call fcn.1000a6b0
mov esi, dword [0x10073440]
cmp dword [0x10073fbc], ebx
jne 0x1000fea7
cmp dword [0x10073fc4], ebx
jne 0x1000fe83
call fcn.100097d0
fild dword [0x1006befc]
push esi
sub esp, 8
fstp dword [esp + 4]
fild dword [0x1006bf00]
fstp dword [esp]
call fcn.10008fa0
add esp, 0xc
call fcn.10009390
call fcn.10009750
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR100.dll__time64]
lea edx, [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.MSVCR100.dll__localtime64]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push edx
push eax
push str._02i:_02i:_02i
push 0x100737a0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
cmp dword [0x10073f58], ebx
je 0x1000fef3
call fcn.1000f6b0
call fcn.1000f510
mov esi, fcn.10002810
push 0x72
mov dword [0x10071724], esi
call fcn.10002810
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x10010062
cmp byte [0x10072940], bl
je 0x1000ff38
cmp dword [0x10072944], ebx
je 0x1000ffa3
call edi
cmp dword [0x10072944], eax
ja 0x1000ffa3
mov eax, dword [0x100731b0]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push edx
push ecx
inc eax
push 0x1005d74c
mov dword [0x100731b0], eax
add eax, 0x9c
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x10001080
push 0x10001060
push str.___1_______:___0x
push eax
mov byte [0x10072940], 1
call fcn.10012eb0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.10012eb0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x73
mov dword [0x10071724], esi
call fcn.10002810
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x1001006d
cmp byte [0x10072948], bl
je 0x1000ffd8
cmp dword [0x1007294c], ebx
je 0x10010043
call edi
cmp dword [0x1007294c], eax
ja 0x10010043
mov eax, dword [0x100731b0]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push edx
push ecx
dec eax
push 0x1005d74c
mov dword [0x100731b0], eax
add eax, 0x9c
push eax
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x10001080
push 0x10001060
push str.____1_______:___0x
push eax
mov byte [0x10072948], 1
call fcn.10012eb0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.10012eb0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.100089e0
test al, al
je 0x1001009c
cmp dword [0x10072dc4], ebx
jne 0x10010083
call fcn.10006d00
cmp eax, ebx
je 0x10010075
mov eax, dword [eax + 0x30]
jmp 0x10010077
mov byte [0x10072940], bl
jmp 0x1000ffa3
mov byte [0x10072948], bl
jmp 0x10010043
xor eax, eax
mov esi, eax
call fcn.10002220
mov dword [0x10072dc4], eax
call fcn.1000d4d0
call fcn.1000e300
call fcn.1000e530
call fcn.1000f030
jmp 0x10010133
mov eax, dword [0x10073e80]
mov dword [0x10073ddc], ebx
mov dword [0x10073d28], ebx
mov dword [0x10073d3c], ebx
mov dword [0x10073e68], ebx
mov dword [0x10073e6c], ebx
mov dword [0x10073eb0], ebx
mov dword [0x10073df4], ebx
mov dword [0x10073eb4], ebx
mov dword [0x10073e90], ebx
mov dword [0x10073ea0], ebx
mov dword [0x10073dd4], ebx
cmp eax, ebx
je 0x10010133
dec eax
cmp eax, 4
ja case.default.0x100100ed
jmp dword [eax*4 + 0x100101c4]
mov dword [0x10073684], 0x3e8
jmp case.default.0x100100ed
mov dword [0x10073684], 0x7d0
jmp case.default.0x100100ed
mov dword [0x10073684], 0xbb8
jmp case.default.0x100100ed
mov dword [0x10073684], 0xfa0
jmp case.default.0x100100ed
mov dword [0x10073684], 0x1388
call fcn.1000eae0
cmp dword [0x10073e94], ebx
je 0x100101a3
mov esi, 0xc
lea edi, [esi - 0xa]
mov ecx, 0x29
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + str.zOGINZlXP_QY]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x30], dl
jns 0x1001016d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x10010150
mov byte [esp + 0x42], 0
mov dword [esp + 0x70], edi
mov ecx, dword [0x10073cd4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [esp + 0x30]
push edx
call eax
mov ecx, dword [eax]
mov dword [esi + ecx], ebx
add esi, 4
mov dword [esp + 0x70], 0xffffffff
cmp esi, 0x34
jl 0x10010143
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.10017f25
mov esp, ebp
pop ebp
ret