Function at 0x10008e10
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x700
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x16]
xor edx, edx
cmp ecx, 0xe9
setne dl
add edx, 5
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
cmp eax, dword [edx + 0x16]
jne 0x10008ea1
cmp dword [ebp - 8], 5
jne 0x10008e7e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
movzx eax, byte [edx + 4]
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 0x1a]
cmp eax, edx
jne 0x10008ea1
cmp dword [ebp - 8], 6
jne 0x10009366
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
movzx edx, word [ecx + 4]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x1a]
cmp edx, ecx
je 0x10009366
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push 0x40
push 8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10009366
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
lea ecx, [ebp - 0xd0]
call fcn.1000c520
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x6fc]
movzx ecx, byte [eax + 0x3c]
test ecx, ecx
je 0x10008f33
mov edx, dword [ebp - 0xb0]
sub edx, dword [ebp - 0xd0]
cmp edx, dword [ebp - 8]
jae 0x10008f33
mov eax, dword [ebp - 0x6fc]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x6fc]
call fcn.10008b50
test eax, eax
je 0x10008f33
mov dword [ebp - 0x700], 1
jmp 0x10008f3d
mov dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10009108
mov byte [ebp - 0xd1], 0xf4
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
lea eax, [ebp - 0xd1]
push eax
call fcn.10009f30
test eax, eax
jne 0x10008f7e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov al, byte [ebp - 0xd1]
mov byte [edx], al
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov byte [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov byte [ebp - 0xd8], 0
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xf4]
push ecx
push 1
call fcn.10006820
add esp, 0xc
movzx edx, al
test edx, edx
je 0x100090f2
mov dword [ebp - 0xf8], 0
jmp 0x1000901c
mov eax, dword [ebp - 0xf8]
add eax, 1
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x6dc], ecx
mov edx, dword [ebp - 0xf8]
cmp edx, dword [ebp - 0x6dc]
jge 0x100090f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xfc], eax
push 0x15
call fcn.10006e80
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
je 0x10009070
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x100]
jae 0x100090d7
mov dword [ebp - 0x3d0], 0x10001
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xe4]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x6e0], edx
lea eax, [ebp - 0x3d0]
push eax
mov ecx, dword [ebp - 0x6e0]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100090c8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x318]
cmp ecx, dword [eax + 0xc]
jbe 0x100090c8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
add eax, 5
cmp dword [ebp - 0x318], eax
jb 0x100090ca
jmp 0x100090d7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009053
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ebp - 0xe4]
mov eax, dword [edx + ecx*4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000900d
lea ecx, [ebp - 0xe4]
call fcn.100035d0
lea ecx, [ebp - 0xf4]
call fcn.100035d0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x16
push ecx
call fcn.10009f30
test eax, eax
jne 0x1000913d
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x16
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
call fcn.1001bea0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [ebp - 0x20], 0
je 0x1000932b
push 0
push 0x10038b7c
call fcn.100063f0
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [eax + 0xa]
mov edx, dword [ebp - 0x3d4]
lea eax, [edx + ecx + 0xe]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x3f0], 0
mov byte [ebp - 0x3ec], 0
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3e0], 0
mov byte [ebp - 0x3dc], 0
lea ecx, [ebp - 0x3e8]
push ecx
lea edx, [ebp - 0x3f8]
push edx
push 1
call fcn.10006820
add esp, 0xc
movzx eax, al
test eax, eax
je 0x10009315
mov dword [ebp - 0x3fc], 0
jmp 0x10009212
mov ecx, dword [ebp - 0x3fc]
add ecx, 1
mov dword [ebp - 0x3fc], ecx
mov edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x6ec], edx
mov eax, dword [ebp - 0x3fc]
cmp eax, dword [ebp - 0x6ec]
jge 0x10009315
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x400], eax
push 0x15
call fcn.10006e80
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
je 0x1000926a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x404]
jae 0x100092fa
mov dword [ebp - 0x6d8], 0x10001
mov ecx, dword [ebp - 0x3fc]
mov edx, dword [ebp - 0x3e8]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x6f0], eax
lea ecx, [ebp - 0x6d8]
push ecx
mov edx, dword [ebp - 0x6f0]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100092eb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x620]
cmp edx, dword [ecx + 0xc]
je 0x100092ed
mov eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0x3d4]
jb 0x100092d0
mov ecx, dword [ebp - 0x3d4]
add ecx, 0xa
cmp dword [ebp - 0x620], ecx
jbe 0x100092ed
mov edx, dword [ebp - 0x620]
and edx, 0xffff0000
mov eax, dword [ebp - 0x3d8]
and eax, 0xffff0000
cmp edx, eax
je 0x100092ed
jmp 0x100092fa
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009249
mov ecx, dword [ebp - 0x3fc]
mov edx, dword [ebp - 0x3e8]
mov eax, dword [edx + ecx*4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10009203
lea ecx, [ebp - 0x3e8]
call fcn.100035d0
lea ecx, [ebp - 0x3f8]
call fcn.100035d0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp - 0x20], 0
je 0x1000935b
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x6fc]
call fcn.10008d70
lea ecx, [ebp - 0xd0]
call fcn.1000c710
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4