Function at 0x10023ae0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1008700c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1008e9f8], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x10023b0d
call fcn.10023720
mov dword [0x1008e9f8], 1
call fcn.1001c370
mov ecx, dword [0x1008d818]
test ecx, ecx
jne 0x10023b28
mov dword [0x1008d12c], 0x32
jmp 0x10023b5c
cmp ecx, 1
jne 0x10023b39
mov dword [0x1008d12c], 6
jmp 0x10023b5c
cmp ecx, 2
jne 0x10023b4a
mov dword [0x1008d12c], 5
jmp 0x10023b5c
mov eax, dword [0x1008d12c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1008d12c], eax
call fcn.10011b10
test eax, eax
je 0x10023bbe
push 0x75
mov dword [0x1008daac], 0x10011e20
call fcn.10011e20
cwde
shr eax, 0x10
test eax, eax
je 0x10023bb7
cmp byte [0x1008f580], 0
je 0x10023b9e
cmp dword [0x1008f584], 0
je 0x10023bbe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1008f584], eax
ja 0x10023bbe
xor eax, eax
mov byte [0x1008f580], 1
cmp dword [0x1008cf40], eax
sete al
mov dword [0x1008cf40], eax
jmp 0x10023bbe
mov byte [0x1008f580], 0
call fcn.1001a280
call fcn.10019fb0
mov ecx, ebx
call fcn.1001a3f0
call fcn.100216f0
mov ecx, ebx
call fcn.1001c020
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x10023c91
cmp dword [0x1008cf44], 0
jne 0x10023c5a
cmp dword [0x10089708], 0
jne 0x10023c5a
cmp dword [0x1008ee40], 0
jne 0x10023c5a
cmp dword [0x1008e0dc], 0
jne 0x10023c5a
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023ccb
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10023cc3
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023ccb
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10023cc6
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023ccb
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023d26
cmp dword [0x1008d7d4], 0
jne 0x10023cf6
cmp dword [0x1008e0a4], 0
je 0x10023d26
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023d60
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10023d54
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023d60
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.1001eb10
mov ecx, ebx
call fcn.1001d9b0
mov ecx, ebx
call fcn.1001e4d0
mov ecx, ebx
call fcn.1001df30
call fcn.1001e170
call fcn.1001e270
call fcn.10020ac0
call fcn.10020e60
call fcn.10021190
call fcn.100209b0
call fcn.10021980
cmp dword [0x1008cf78], 0
je 0x10023e55
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023e55
push 0x20
mov dword [0x1008daac], 0x10011e20
call fcn.10011e20
cwde
shr eax, 0x10
test eax, eax
je 0x10023e4e
cmp byte [0x1008f2d8], 0
je 0x10023e09
cmp dword [0x1008f2dc], 0
je 0x10023e55
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x1008f2dc]
inc ecx
cmp ecx, eax
ja 0x10023e55
jmp 0x10023e0f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x1008f2d8], 1
call edi
mov ecx, dword [0x1008d3cc]
mov dword [0x1008f2dc], eax
mov eax, dword [0x10089760]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10023e90
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x10023e84
mov byte [0x1008f2d8], 0
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10023e90
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10021300
call fcn.100213b0
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x168
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10023f39
cmp dword [0x1008ee0c], 1
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
mov edx, dword [ecx]
jne 0x10023f0b
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x1008d3cc]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10089760]
je 0x10023f0b
add eax, 0x168
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10023f39
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x10023f2d
add eax, 0x168
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x10023f39
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10021d90
call fcn.1001f250
call fcn.1001f190
cmp dword [0x1008d374], 0
jle 0x10023f9a
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023f9a
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023fd4
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10023fc8
mov ecx, dword [0x1008d3cc]
mov eax, dword [0x10089760]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023fd4
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10021be0
call fcn.1001e370
call fcn.10021cd0
call fcn.10021830
call fcn.10021520
call fcn.100215c0
call fcn.10022a20
call fcn.10022730
call fcn.10022c70
mov ecx, ebx
call fcn.10022ab0
call fcn.10021ed0
call fcn.10022610
call fcn.100222b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cab9
mov esp, ebp
pop ebp
ret