Function at 0x1001ccc0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10055554], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x1001cecd
call fcn.1001cbd0
mov eax, dword [0x10054500]
lea esi, [eax + 0x40]
test esi, esi
je 0x1001cd1e
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x44]
test esi, esi
je 0x1001cd47
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x48]
test esi, esi
je 0x1001cd70
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x4c]
test esi, esi
je 0x1001cd99
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x50]
test esi, esi
je 0x1001cdc2
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x54]
test esi, esi
je 0x1001cdeb
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x10054500]
lea esi, [eax + 0x58]
test esi, esi
je 0x1001ce0f
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.100067a0
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x10050308], 0
jne 0x1001ce58
mov ecx, dword [0x10053f2c]
push 0x10054a4c
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
je 0x1001ce50
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x1001ca60
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x1001ce52
xor ebx, ebx
mov dword [0x10050308], ebx
cmp dword [0x10054320], 0
jne 0x1001cec0
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
test ebx, ebx
je 0x1001ceb9
push 0xc
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x1001cebb
xor eax, eax
mov dword [0x10054320], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x10055554], 1
call fcn.10014710
mov ecx, dword [0x10054374]
test ecx, ecx
jne 0x1001cee8
mov dword [0x10053c8c], 0x32
jmp 0x1001cf1c
cmp ecx, 1
jne 0x1001cef9
mov dword [0x10053c8c], 6
jmp 0x1001cf1c
cmp ecx, 2
jne 0x1001cf0a
mov dword [0x10053c8c], 5
jmp 0x1001cf1c
mov eax, dword [0x10053c8c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10053c8c], eax
call fcn.100127b0
mov ecx, ebx
call fcn.10012850
call fcn.1001a690
mov ecx, ebx
call fcn.100143c0
mov ecx, ebx
call fcn.10017ac0
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001cfe5
cmp dword [0x10053aa4], 0
jne 0x1001cfae
cmp dword [0x10055998], 0
jne 0x1001cfae
cmp dword [0x10054c3c], 0
jne 0x1001cfae
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d01f
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046640]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x1001d01a
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d01f
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1001d01a
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d01f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046640]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d078
cmp dword [0x10054334], 0
jne 0x1001d04a
cmp dword [0x10054c04], 0
je 0x1001d078
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d0b2
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
jmp 0x1001d0a4
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d0b2
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046694]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.10017590
mov ecx, ebx
call fcn.10016300
mov ecx, ebx
call fcn.10016e10
mov ecx, ebx
call fcn.10016880
mov ecx, ebx
call fcn.10016ad0
mov ecx, ebx
call fcn.10016bd0
call fcn.10019b10
call fcn.10019eb0
call fcn.1001a1e0
call fcn.10019a00
call fcn.1001aa10
cmp dword [0x10053ad8], 0
je 0x1001d1e6
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d1e6
push 0x20
mov dword [0x10054600], 0x1000b400
call fcn.1000b400
cwde
shr eax, 0x10
test eax, eax
je 0x1001d1a7
cmp byte [0x10055e40], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x1001d15d
cmp dword [0x10055e44], 0
je 0x1001d1ae
call esi
mov ecx, dword [0x10055e44]
inc ecx
cmp ecx, eax
ja 0x1001d1ae
mov byte [0x10055e40], 1
call esi
mov ecx, dword [0x10053f2c]
mov dword [0x10055e44], eax
mov eax, dword [0x100506ac]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
test esi, esi
je 0x1001d221
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046698]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
jmp 0x1001d21c
mov byte [0x10055e40], 0
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
test esi, esi
je 0x1001d221
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004669c]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1001d21c
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
test esi, esi
je 0x1001d221
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004669c]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 1
push esi
call edi
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [0x10053f2c]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100506ac]
je 0x1001d271
add eax, 0x150
cmp dword [0x10054b60], 0
push eax
je 0x1001d277
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d29e
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
jmp 0x1001d290
add eax, 0x150
push eax
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d29e
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046694]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.1001a350
call fcn.1001ae20
cmp dword [0x1005437c], 0
jle 0x1001d31d
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d31d
cmp dword [0x100507b8], 1
jne 0x1001d36a
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x138
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d311
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov dword [0x100507b8], 0
jmp 0x1001d36a
cmp dword [0x100507b8], 0
jne 0x1001d36a
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x138
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d360
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046690]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov dword [0x100507b8], 1
call fcn.100182a0
cmp dword [0x100559c4], 0
jle 0x1001d3c8
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d3c8
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d402
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
jmp 0x1001d3fd
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d402
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046690]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 1
push esi
call edi
cmp dword [0x10053ed4], 0
jle 0x1001d49d
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001d49d
mov eax, dword [0x10053ed4]
cmp eax, 1
jne 0x1001d43e
mov dword [0x10050434], 0x42c80000
jmp 0x1001d46f
cmp eax, 2
jne 0x1001d44f
mov dword [0x10050434], 0x42dc0000
jmp 0x1001d46f
cmp eax, 3
jne 0x1001d460
mov dword [0x10050434], 0x42f00000
jmp 0x1001d46f
cmp eax, 4
jne 0x1001d46f
mov dword [0x10050434], 0x43020000
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d4d7
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1004663c]
jmp 0x1001d4c9
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
test esi, esi
je 0x1001d4d7
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10046690]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.1001ac70
call fcn.10016cd0
call fcn.1001ad60
call fcn.1001a840
call fcn.1001a4c0
call fcn.1001a560
call fcn.1001ba70
call fcn.1001b780
call fcn.1001bcc0
mov ecx, ebx
call fcn.1001bb00
call fcn.1001af60
call fcn.1001b660
call fcn.1001b320
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037659
mov esp, ebp
pop ebp
ret