Function at 0x10023200
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006b4ac], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x1002347c
call fcn.10023110
mov eax, dword [0x1006a46c]
mov ebx, fcn.10006d80
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x1002326f
cmp ebx, 0x1000
jbe 0x1002326f
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x100232a4
cmp ebx, 0x1000
jbe 0x100232a4
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x48]
cmp esi, 0x1000
jbe 0x100232d9
cmp ebx, 0x1000
jbe 0x100232d9
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002330e
cmp ebx, 0x1000
jbe 0x1002330e
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x50]
cmp esi, 0x1000
jbe 0x10023343
cmp ebx, 0x1000
jbe 0x10023343
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10023378
cmp ebx, 0x1000
jbe 0x10023378
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x100233a8
cmp ebx, 0x1000
jbe 0x100233a8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x1006c034], 0
jne 0x10023403
mov ecx, dword [0x10069ea0]
push 0x1006aab4
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
cmp esi, 0x1000
jbe 0x100233fb
mov eax, 0x10022fa0
cmp eax, 0x1000
jbe 0x100233fb
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10022fa0
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x100233fd
xor ebx, ebx
mov dword [0x1006c034], ebx
cmp dword [0x1006a294], 0
jne 0x1002346f
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x10023468
push 0xc
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x1002346a
xor eax, eax
mov dword [0x1006a294], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x1006b4ac], 1
call fcn.1001be50
mov ecx, dword [0x1006a2e4]
test ecx, ecx
jne 0x10023497
mov dword [0x1006f9a0], 0x32
jmp 0x100234cb
cmp ecx, 1
jne 0x100234a8
mov dword [0x1006f9a0], 6
jmp 0x100234cb
cmp ecx, 2
jne 0x100234b9
mov dword [0x1006f9a0], 5
jmp 0x100234cb
mov eax, dword [0x1006f9a0]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1006f9a0], eax
call fcn.10019d10
call fcn.10019c70
mov ecx, ebx
call fcn.10019e80
call fcn.10021020
mov ecx, ebx
call fcn.1001bb00
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002359a
cmp dword [0x1006f7b8], 0
jne 0x1002355f
cmp dword [0x1006b8f0], 0
jne 0x1002355f
cmp dword [0x1006ab94], 0
jne 0x1002355f
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100235d8
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d870]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x100235d3
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100235d8
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d86c]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x100235d3
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x100235d8
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d870]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023635
cmp dword [0x1006a2a8], 0
jne 0x10023603
cmp dword [0x1006ab5c], 0
je 0x10023635
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023673
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d86c]
jmp 0x10023665
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023673
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d8c4]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.1001e5d0
mov ecx, ebx
call fcn.1001d490
mov ecx, ebx
call fcn.1001df90
mov ecx, ebx
call fcn.1001da10
call fcn.1001dc50
call fcn.1001dd40
call fcn.100203f0
call fcn.10020790
call fcn.10020ac0
call fcn.100202e0
call fcn.100212b0
cmp dword [0x1006f7ec], 0
je 0x10023762
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023762
push 0x20
mov dword [0x1006a56c], 0x10011ae0
call fcn.10011ae0
cwde
shr eax, 0x10
test eax, eax
je 0x1002375b
cmp byte [0x1006fe20], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x1002371a
cmp dword [0x1006fe24], 0
je 0x10023762
call esi
mov ecx, dword [0x1006fe24]
inc ecx
cmp ecx, eax
ja 0x10023762
mov byte [0x1006fe20], 1
call esi
mov ecx, dword [0x10069ea0]
mov dword [0x1006fe24], eax
mov eax, dword [0x1006c3c4]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x100237a1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d8c8]
jmp 0x10023793
mov byte [0x1006fe20], 0
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x100237a1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d8cc]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10020c30
call fcn.10020ce0
call fcn.100216c0
call fcn.1001eb80
call fcn.1001eac0
cmp dword [0x1006fbe8], 0
jle 0x1002380e
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002380e
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x1002384c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d86c]
jmp 0x1002383e
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x1002384c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1005d8c0]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10021510
call fcn.1001de40
call fcn.10021600
call fcn.10021160
call fcn.10020e50
call fcn.10020ef0
call fcn.10022310
call fcn.10022020
call fcn.10022560
mov ecx, ebx
call fcn.100223a0
call fcn.10021800
call fcn.10021f00
call fcn.10021bc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100473e9
mov esp, ebp
pop ebp
ret