Function at 0x1000fa90
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049760
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1000f5f0
call fcn.1000f850
cmp dword [0x10074eec], 0
je 0x1000fb3a
mov edi, str._9__860__87_9__
sub edi, 0x6fad512a
lea esi, [ebp - 0x58]
call fcn.10014a30
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
fld dword [0x1005f440]
mov ecx, dword [eax]
mov edi, 0x1005ebd8
fstp dword [ecx]
sub edi, 0x16440e0f
lea esi, [ebp - 0x58]
call fcn.10014e30
mov dword [ebp - 4], 1
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
fld dword [0x1005f3c8]
mov ecx, dword [eax]
fstp dword [ecx + 4]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10074f9c], 0
jne 0x1000fb4c
cmp dword [0x10074fa4], 0
je 0x1000fb9f
call fcn.10007eb0
push eax
call fcn.10007e20
push eax
call fcn.10008bf0
add esp, 4
mov ecx, eax
call fcn.100086c0
mov ebx, eax
test ebx, ebx
je 0x1000fb9f
cmp dword [0x10074fa4], 0
je 0x1000fb9f
mov edi, 0x10221749
lea esi, [ebp - 0x28]
call fcn.10016c00
mov dword [ebp - 4], 2
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov dword [eax + ebx], 0
cmp dword [0x10074ecc], 0
lea esi, [ebp - 0x54]
je 0x1000fbe6
mov edi, 0x10290441
call fcn.10016c40
mov dword [ebp - 4], 3
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x5c]
push ecx
push 0x40
mov esi, eax
push 1
push esi
call ebx
push 1
push 0x1005ec1c
jmp 0x1000fc1f
mov edi, 0x10211b94
call fcn.10016c80
mov dword [ebp - 4], 4
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x5c]
push ecx
push 0x40
mov esi, eax
push 1
push esi
call ebx
push 1
push 0x1005ec44
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x5c]
add esp, 0xc
lea edx, [ebp - 0x60]
push edx
push eax
push 1
push esi
call ebx
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10074f34], 0
je 0x1000fc8c
call fcn.10009530
mov esi, eax
call fcn.10007eb0
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [edx + 0x3c]
push str.IFHPB.Pointer.getNickForSlot
call eax
add eax, edi
mov eax, dword [eax + esi*4]
add eax, 8
cmp byte [eax], 0
je 0x1000fc8c
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x1000fc83
xor edi, edi
cmp dword [0x10074f58], edi
je 0x1000fca9
fldz
mov dword [0x10074f54], edi
fstp dword [0x1007507c]
jmp 0x1000fd3c
cmp dword [0x10074f54], edi
je 0x1000fd3c
push 0x12
mov dword [0x10074f58], edi
mov dword [0x10072738], 0x10002950
call fcn.10002950
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x1000fd03
cmp byte [0x100736f0], 0
je 0x1000fcf5
cmp dword [0x100736f4], edi
je 0x1000fd0a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100736f4], eax
ja 0x1000fd0a
mov byte [0x100736f0], 1
mov eax, 1
jmp 0x1000fd0c
mov byte [0x100736f0], 0
xor eax, eax
test al, 1
je 0x1000fd14
fldz
jmp 0x1000fd1a
fld dword [0x1005f43c]
push str.BomControl_Aktif__OFF___Tekan_ALT_
fstp dword [0x1006d890]
push 0xffffff00
push 0xdc
mov ecx, 0x15e
call fcn.1000d520
add esp, 0xc
cmp dword [0x10074ea8], edi
je 0x1000fd5f
call fcn.10007eb0
push eax
call fcn.10007e20
push eax
call fcn.10008bf0
add esp, 4
mov esi, eax
call fcn.100087c0
cmp dword [0x10074f38], edi
je 0x1000fe45
mov ecx, 0x595ddc13
lea eax, [ebp - 0x20]
call fcn.10016cc0
push edi
push 2
mov dword [ebp - 4], 5
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0xd
push eax
mov eax, dword [edx + 0x3c]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 4
push str.keybd_event
push 0x1005d98c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push eax
call fcn.100167d0
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100750a4], eax
ja 0x1000fe45
push str.Exit_Game
push 0x70b
call fcn.10008fc0
push eax
call fcn.10008f00
mov ecx, 0x719556a7
lea eax, [ebp - 0x20]
call fcn.10016d40
push 0
push 0
mov dword [ebp - 4], 6
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0xd
push eax
mov eax, dword [edx + 0x3c]
call eax
push eax
push 4
push str.keybd_event
push 0x1005d98c
call edi
push eax
call esi
push eax
call fcn.100167d0
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x64
mov dword [0x100750a4], eax
cmp dword [0x10074e94], 0
je 0x1000fe70
call fcn.10007eb0
push eax
call fcn.10007e20
push eax
call fcn.10008bf0
add esp, 4
mov edi, eax
call fcn.10009100
mov esi, eax
call fcn.10009050
mov edi, 0x1005cf28
sub edi, 0x6fad512a
cmp dword [0x10074e98], 0
lea esi, [ebp - 0x2c]
je 0x1000fec1
mov dword [0x10074e94], 0
call fcn.100146f0
mov dword [ebp - 4], 7
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
lea ecx, [ebp - 0x5c]
push ecx
push 0x40
mov esi, eax
push 3
push esi
call ebx
push 3
push 0x1005ecb4
jmp 0x1000feef
call fcn.100146f0
mov dword [ebp - 4], 8
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
lea ecx, [ebp - 0x5c]
push ecx
push 0x40
mov esi, eax
push 3
push esi
call ebx
push 3
push 0x1005ecb8
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x5c]
add esp, 0xc
lea edx, [ebp - 0x60]
push edx
push eax
push 3
push esi
call ebx
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x10074e7c]
cmp eax, 1
jne 0x1000ff91
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 9
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xa
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [edx + 0x3c]
push ebx
call eax
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx + 0x3c]
push eax
add edi, esi
call edx
mov dword [eax + edi], 0x30
jmp 0x100101d7
cmp eax, 2
jne 0x10010007
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 0xb
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xc
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
push ebx
call edx
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x5c]
mov eax, dword [eax + 0x3c]
push edx
add edi, esi
call eax
mov dword [eax + edi], 0x31
jmp 0x100101d7
cmp eax, 3
jne 0x1001007d
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 0xd
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xe
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [edx + 0x3c]
push ebx
call eax
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx + 0x3c]
push eax
add edi, esi
call edx
mov dword [eax + edi], 0x32
jmp 0x100101d7
cmp eax, 4
jne 0x100100f3
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 0xf
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x10
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
push ebx
call edx
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x5c]
mov eax, dword [eax + 0x3c]
push edx
add edi, esi
call eax
mov dword [eax + edi], 0x33
jmp 0x100101d7
cmp eax, 5
jne 0x10010166
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 0x11
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x12
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [edx + 0x3c]
push ebx
call eax
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx + 0x3c]
push eax
add edi, esi
call edx
mov dword [eax + edi], 0x35
jmp 0x100101d7
cmp eax, 6
jne 0x100101d7
mov edi, 0x1005e174
sub edi, 0x6fad512a
lea esi, [ebp - 0x2c]
call fcn.10015000
mov ebx, eax
mov edi, 0x10211101
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 0x13
call fcn.10016dc0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x14
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov esi, eax
shl esi, 6
add esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
push ebx
call edx
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x5c]
mov eax, dword [eax + 0x3c]
push edx
add edi, esi
call eax
mov dword [eax + edi], 0x36
mov edi, 0x1005e174
lea esi, [ebp - 0x2c]
sub edi, 0x6fad512a
call fcn.10015000
cmp dword [0x10074ec4], 0
mov ebx, eax
je 0x10010251
mov edi, 0x1037ed3a
lea esi, [ebp - 0x50]
mov dword [ebp - 4], 0x15
call fcn.10014d70
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x16
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
lea esi, [eax + eax*8]
mov eax, dword [edx + 0x3c]
add esi, esi
add esi, esi
push ebx
add esi, esi
call eax
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
mov edx, dword [edx + 0x3c]
push eax
add edi, esi
call edx
mov dword [eax + edi + 0x34], 0x44096546
jmp 0x100102ab
mov edi, 0x1037ed3a
lea esi, [ebp - 0x50]
mov dword [ebp - 4], 0x17
call fcn.10014d70
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x18
call fcn.10007eb0
push eax
call fcn.10007e20
mov ecx, dword [0x10074d84]
lea esi, [eax + eax*8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x3c]
add esi, esi
add esi, esi
push ebx
add esi, esi
call edx
mov edi, dword [eax]
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x5c]
mov eax, dword [eax + 0x3c]
push edx
add edi, esi
call eax
mov dword [eax + edi + 0x34], 0xb7a7c5ac
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10074f0c], 0
je 0x10010550
fld dword [0x1005f438]
sub esp, 8
fstp dword [esp + 4]
call fcn.10009530
add esp, 4
push eax
call fcn.10008bf0
add esp, 4
push eax
call fcn.10008b50
test al, al
jne 0x100104f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100750a4], eax
lea eax, [ebp - 0x20]
ja 0x10010413
mov ecx, 0x1005ecd8
sub ecx, 0x6362e12f
call fcn.10016e00
push 0
push 0
mov dword [ebp - 4], 0x19
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x85
push 0x34
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 4
push str.keybd_event
push 0x1005d98c
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push eax
call fcn.100167d0
add esp, 0x1c
mov ecx, 0x2dec5f56
lea eax, [ebp - 0x20]
call fcn.10016e80
mov esi, eax
push 0
push 0
mov dword [ebp - 4], 0x1a
call fcn.10008060
push eax
call fcn.10007fd0
push eax
push ecx
call fcn.10008060
push eax
call fcn.10007f40
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
add esp, 4
push eax
mov eax, dword [edx + 0x3c]
push 1
push esi
call eax
push eax
push 5
push 0x1005eaf8
push 0x1005d98c
call ebx
push eax
call edi
push eax
call fcn.100167d0
add esp, 0x20
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10015110
mov dword [ebp - 4], 0x1b
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
mov eax, dword [edx + 0x38]
mov dword [eax + 0x68], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xfa0
mov dword [0x100750a4], eax
jmp 0x100104f1
mov ecx, 0x87503c74
call fcn.10016f00
push 0
push 0
push 0
mov dword [ebp - 4], 0x1c
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0
push 1
push eax
mov eax, dword [edx + 0x3c]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 5
push 0x1005eaf8
push 0x1005d98c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push eax
call fcn.100167d0
add esp, 0x20
mov ecx, 0x3c3fd5d3
lea eax, [ebp - 0x20]
call fcn.10016f80
push 0
push 2
mov dword [ebp - 4], 0x1d
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x85
push 0x34
push eax
mov eax, dword [edx + 0x3c]
call eax
push eax
push 4
push str.keybd_event
push 0x1005d98c
call edi
push eax
call esi
push eax
call fcn.100167d0
add esp, 0x1c
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10015110
mov dword [ebp - 4], 0x1e
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
mov eax, dword [edx + 0x38]
mov dword [eax + 0x68], 0
mov dword [ebp - 4], 0xffffffff
fld dword [0x1005f438]
sub esp, 8
fstp dword [esp + 4]
call fcn.10009530
add esp, 4
push eax
call fcn.10008bf0
add esp, 4
push eax
call fcn.10008b50
test al, al
je 0x10010550
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10015110
mov dword [ebp - 4], 0x1f
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
mov eax, dword [edx + 0x38]
mov dword [eax + 0x68], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret