Function at 0x1000add0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1001aeb0]
mov eax, dword [eax + 0x2c]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
xor ebx, ebx
push ebx
push 4
lea ecx, [ebp - 4]
push ecx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call edi
mov edx, dword [0x1001aeb0]
mov eax, dword [edx + 0x44]
add eax, dword [ebp - 4]
push ebx
push 4
lea ecx, [ebp - 8]
push ecx
push eax
call esi
push eax
call edi
mov eax, dword [ebp - 8]
mov dword [0x1001a738], eax
cmp eax, ebx
je 0x1000b13e
mov edx, dword [eax]
push 0x1001a86c
push eax
mov eax, dword [edx + 0xc0]
call eax
mov esi, dword [0x1001a738]
mov edi, esi
call fcn.100072a0
cmp dword [0x1001aec4], ebx
jne 0x1000ae7b
cmp dword [0x1001b108], ebx
jne 0x1000ae57
call fcn.10006250
fild dword [0x10016088]
push edi
sub esp, 8
fstp dword [esp + 4]
fild dword [0x1001608c]
fstp dword [esp]
call fcn.10005c10
add esp, 0xc
call fcn.10005ec0
call fcn.100061e0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll__time64]
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR100.dll__localtime64]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push ecx
push edx
push eax
push str._02i:_02i:_02i
push 0x1001a998
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
cmp dword [0x1001b0a4], ebx
je 0x1000aebf
call fcn.1000ac90
call fcn.1000a900
call fcn.1000aa30
mov ecx, dword [0x1001aeb0]
mov edx, dword [ecx + 0x10]
cmp dword [edx], ebx
jbe 0x1000aefb
call fcn.10008310
call fcn.10008b40
call fcn.10008df0
call fcn.10008ef0
call fcn.10009cc0
call fcn.100092f0
call fcn.10009560
jmp 0x1000af31
mov dword [0x1001af68], ebx
mov dword [0x1001aed8], ebx
mov dword [0x1001aeec], ebx
mov dword [0x1001afd4], ebx
mov dword [0x1001afd8], ebx
mov dword [0x1001b00c], ebx
mov dword [0x1001af70], ebx
mov dword [0x1001b010], ebx
mov dword [0x1001afd0], ebx
mov esi, fcn.100014c0
push 0x57
mov dword [0x10019010], esi
call fcn.100014c0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x1000af77
cmp byte [0x10019c88], bl
je 0x1000af6b
cmp dword [0x10019c8c], ebx
je 0x1000af7d
call edi
cmp dword [0x10019c8c], eax
ja 0x1000af7d
mov byte [0x10019c88], 1
jmp 0x1000b00b
mov byte [0x10019c88], bl
push 0x41
mov dword [0x10019010], esi
call fcn.100014c0
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x1000afb7
cmp byte [0x10019bd8], bl
je 0x1000afae
cmp dword [0x10019bdc], ebx
je 0x1000afbd
call edi
cmp dword [0x10019bdc], eax
ja 0x1000afbd
mov byte [0x10019bd8], 1
jmp 0x1000b00b
mov byte [0x10019bd8], bl
push 0x53
mov dword [0x10019010], esi
call fcn.100014c0
movsx edx, ax
shr edx, 0x10
test edx, edx
je 0x1000aff7
cmp byte [0x10019c68], bl
je 0x1000afee
cmp dword [0x10019c6c], ebx
je 0x1000affd
call edi
cmp dword [0x10019c6c], eax
ja 0x1000affd
mov byte [0x10019c68], 1
jmp 0x1000b00b
mov byte [0x10019c68], bl
xor edi, edi
lea esi, [edi + 0x44]
call fcn.10001510
test eax, eax
je 0x1000b011
mov dword [0x1001afd0], ebx
mov eax, dword [0x1001aeb0]
cmp dword [0x1001affc], ebx
je 0x1000b068
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx]
dec ecx
je 0x1000b068
dec ecx
je 0x1000b068
sub ecx, 3
jne 0x1000b068
mov edx, dword [eax + 0x10]
cmp dword [edx], ebx
ja 0x1000b068
mov esi, dword [eax + 0x16c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call edi
mov eax, dword [ebp - 8]
mov ecx, 0x100091d0
lea edx, [ebp - 4]
push edx
sub ecx, esi
sub ecx, 5
push eax
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
push 5
jmp 0x1000b09a
mov esi, dword [eax + 0x16c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 6
push esi
call edi
push 6
push 0x10013b24
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 6
push esi
call edi
mov ecx, dword [0x1001aeb0]
cmp dword [0x1001aff4], ebx
je 0x1000b0c0
mov eax, 0xc
mov edx, dword [ecx + 0x30]
mov edx, dword [edx]
mov dword [eax + edx], ebx
add eax, 4
cmp eax, 0x38
jl 0x1000b0b0
cmp dword [0x1001aff8], ebx
je 0x1000b13e
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
dec eax
je 0x1000b13e
dec eax
jne 0x1000b13e
mov ebx, dword [0x1001a614]
mov eax, dword [0x1001a88c]
mov esi, dword [eax + ebx + 1]
lea edx, [ebp - 4]
push edx
push 0x40
add eax, ebx
push 5
push ebx
mov dword [ebp - 8], eax
call edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push ecx
sub esi, ebx
add esi, dword [ebp - 8]
push 5
push ebx
mov byte [ebx], 0xe8
mov dword [ebx + 1], esi
call edi
mov edx, dword [0x1001aeb0]
mov esi, dword [edx + 0x104]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call edi
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push eax
mov ecx, 0x10009260
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret