Function at 0x1000ae40
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1001a180]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5064]
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [0x10019a2c], eax
cmp eax, ebx
je 0x1000b145
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc0]
push esi
push edi
push 0x10019b50
push eax
call edx
mov esi, dword [0x10019a2c]
mov edi, esi
call fcn.10007590
cmp dword [0x1001a194], ebx
jne 0x1000aebe
cmp dword [0x1001a3d8], ebx
jne 0x1000ae9a
call fcn.100064a0
fild dword [0x100151e8]
push edi
sub esp, 8
fstp dword [esp + 4]
fild dword [0x100151ec]
fstp dword [esp]
call fcn.10005e60
add esp, 0xc
call fcn.10006110
call fcn.10006430
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax + 8]
push ecx
push edx
push str._02i:_02i:_02i
push 0x10019c78
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
cmp dword [0x1001a374], ebx
je 0x1000af02
call fcn.1000ad10
call fcn.1000a8f0
call fcn.1000aa20
mov eax, dword [0x1001a180]
mov ecx, dword [eax + 0x10]
cmp dword [ecx], ebx
jbe 0x1000af3d
call fcn.10008080
call fcn.100088b0
call fcn.10008b60
call fcn.10008c60
call fcn.10009db0
call fcn.100090a0
call fcn.100093b0
jmp 0x1000af73
mov dword [0x1001a238], ebx
mov dword [0x1001a1a8], ebx
mov dword [0x1001a1bc], ebx
mov dword [0x1001a2a4], ebx
mov dword [0x1001a2a8], ebx
mov dword [0x1001a2dc], ebx
mov dword [0x1001a240], ebx
mov dword [0x1001a2e0], ebx
mov dword [0x1001a2a0], ebx
mov esi, fcn.10001490
push 0x57
mov dword [0x10018338], esi
call fcn.10001490
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
movsx edx, ax
shr edx, 0x10
test edx, edx
je 0x1000afbb
cmp byte [0x10018f90], bl
je 0x1000afaf
cmp dword [0x10018f94], ebx
je 0x1000afc1
call edi
cmp dword [0x10018f94], eax
ja 0x1000afc1
mov byte [0x10018f90], 1
jmp 0x1000b04d
mov byte [0x10018f90], bl
push 0x41
mov dword [0x10018338], esi
call fcn.10001490
cwde
shr eax, 0x10
test eax, eax
je 0x1000aff9
cmp byte [0x10018ee0], bl
je 0x1000aff0
cmp dword [0x10018ee4], ebx
je 0x1000afff
call edi
cmp dword [0x10018ee4], eax
ja 0x1000afff
mov byte [0x10018ee0], 1
jmp 0x1000b04d
mov byte [0x10018ee0], bl
push 0x53
mov dword [0x10018338], esi
call fcn.10001490
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x1000b039
cmp byte [0x10018f70], bl
je 0x1000b030
cmp dword [0x10018f74], ebx
je 0x1000b03f
call edi
cmp dword [0x10018f74], eax
ja 0x1000b03f
mov byte [0x10018f70], 1
jmp 0x1000b04d
mov byte [0x10018f70], bl
xor edi, edi
lea esi, [edi + 0x44]
call fcn.100014a0
test eax, eax
je 0x1000b053
mov dword [0x1001a2a0], ebx
mov eax, dword [0x1001a180]
cmp dword [0x1001a2cc], ebx
je 0x1000b0aa
mov edx, dword [eax + 0x18]
mov ecx, dword [edx]
dec ecx
je 0x1000b0aa
dec ecx
je 0x1000b0aa
sub ecx, 3
jne 0x1000b0aa
mov ecx, dword [eax + 0x10]
cmp dword [ecx], ebx
ja 0x1000b0aa
mov esi, dword [eax + 0x16c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push esi
call edi
mov edx, dword [ebp - 4]
mov eax, 0x10008f10
lea ecx, [ebp - 8]
push ecx
sub eax, esi
sub eax, 5
push edx
mov byte [esi], 0xe9
mov dword [esi + 1], eax
push 5
jmp 0x1000b0dc
mov esi, dword [eax + 0x16c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call edi
push 6
push 0x10012550
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push 6
push esi
call edi
mov ecx, dword [0x1001a180]
cmp dword [0x1001a2c4], ebx
je 0x1000b102
mov eax, 0xc
mov edx, dword [ecx + 0x30]
mov edx, dword [edx]
mov dword [eax + edx], ebx
add eax, 4
cmp eax, 0x38
jl 0x1000b0f2
cmp dword [0x1001a2c8], ebx
je 0x1000b143
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
dec eax
je 0x1000b143
dec eax
jne 0x1000b143
mov esi, dword [ecx + 0x104]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
mov edx, 0x10009020
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret