Function at 0x100237e0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006e00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10075420], 0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], ebx
jne 0x10023a5c
call fcn.100236f0
mov eax, dword [0x100743d8]
mov ebx, fcn.10006e50
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x1002384f
cmp ebx, 0x1000
jbe 0x1002384f
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10023884
cmp ebx, 0x1000
jbe 0x10023884
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x48]
cmp esi, 0x1000
jbe 0x100238b9
cmp ebx, 0x1000
jbe 0x100238b9
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x100238ee
cmp ebx, 0x1000
jbe 0x100238ee
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x50]
cmp esi, 0x1000
jbe 0x10023923
cmp ebx, 0x1000
jbe 0x10023923
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10023958
cmp ebx, 0x1000
jbe 0x10023958
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x100743d8]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10023988
cmp ebx, 0x1000
jbe 0x10023988
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
cmp dword [0x10075fac], 0
jne 0x100239e3
mov ecx, dword [0x10073e04]
push 0x10074a24
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [eax]
add esi, 0x38
cmp esi, 0x1000
jbe 0x100239db
mov eax, 0x10023580
cmp eax, 0x1000
jbe 0x100239db
mov ebx, dword [esi]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10023580
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
jmp 0x100239dd
xor ebx, ebx
mov dword [0x10075fac], ebx
cmp dword [0x100741f8], 0
jne 0x10023a4f
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x10023a48
push 0xc
call fcn.1004cb44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov ecx, dword [ebx]
mov dword [esi], ecx
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov al, byte [ebx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub ebx, eax
mov byte [eax], 0xe9
add ebx, 2
mov dword [eax + 1], ebx
add eax, 0xfffffff9
jmp 0x10023a4a
xor eax, eax
mov dword [0x100741f8], eax
mov ebx, dword [ebp - 0x48]
mov dword [0x10075420], 1
call fcn.1001c250
mov ecx, dword [0x10074248]
test ecx, ecx
jne 0x10023a77
mov dword [0x10073b64], 0x32
jmp 0x10023aab
cmp ecx, 1
jne 0x10023a88
mov dword [0x10073b64], 6
jmp 0x10023aab
cmp ecx, 2
jne 0x10023a99
mov dword [0x10073b64], 5
jmp 0x10023aab
mov eax, dword [0x10073b64]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10073b64], eax
call fcn.1001a160
call fcn.10019e90
mov ecx, ebx
call fcn.1001a2d0
call fcn.100215e0
mov ecx, ebx
call fcn.1001bf00
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023b83
cmp dword [0x1007397c], 0
jne 0x10023b48
cmp dword [0x10070140], 0
jne 0x10023b48
cmp dword [0x10075868], 0
jne 0x10023b48
cmp dword [0x10074b08], 0
jne 0x10023b48
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023bc1
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063840]
mov byte [esi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10023bbc
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023bc1
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006383c]
mov byte [esi], al
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
jmp 0x10023bbc
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0xfc
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023bc1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063840]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023c1e
cmp dword [0x1007420c], 0
jne 0x10023bec
cmp dword [0x10074ad0], 0
je 0x10023c1e
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023c5c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006383c]
jmp 0x10023c4e
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023c5c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006389c]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
mov ecx, ebx
call fcn.1001e9f0
mov ecx, ebx
call fcn.1001d890
mov ecx, ebx
call fcn.1001e3b0
mov ecx, ebx
call fcn.1001de10
call fcn.1001e050
call fcn.1001e150
call fcn.100209b0
call fcn.10020d50
call fcn.10021080
call fcn.100208a0
call fcn.10021870
cmp dword [0x100739b0], 0
je 0x10023d4b
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023d4b
push 0x20
mov dword [0x100744dc], 0x10011ce0
call fcn.10011ce0
cwde
shr eax, 0x10
test eax, eax
je 0x10023d44
cmp byte [0x100762a8], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10023d03
cmp dword [0x100762ac], 0
je 0x10023d4b
call esi
mov ecx, dword [0x100762ac]
inc ecx
cmp ecx, eax
ja 0x10023d4b
mov byte [0x100762a8], 1
call esi
mov ecx, dword [0x10073e04]
mov dword [0x100762ac], eax
mov eax, dword [0x10070198]
add eax, 0x154
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10023d8a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100638a0]
jmp 0x10023d7c
mov byte [0x100762a8], 0
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [eax + 2]
cmp esi, 0x1000
jbe 0x10023d8a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100638a4]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.100211f0
call fcn.100212a0
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x168
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10023e39
cmp dword [0x10075834], 1
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
mov edx, dword [ecx]
jne 0x10023e07
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x10073e04]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10070198]
je 0x10023e07
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10023e39
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100638c4]
jmp 0x10023e2b
add eax, 0x168
push eax
call dword [edx + 4]
lea esi, [eax + 3]
cmp esi, 0x1000
jbe 0x10023e39
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x100638c8]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10021c80
call fcn.1001f140
call fcn.1001f070
cmp dword [0x10073dac], 0
jle 0x10023e9c
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023e9c
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023eda
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x1006383c]
jmp 0x10023ecc
mov ecx, dword [0x10073e04]
mov eax, dword [0x10070198]
add eax, 0x13c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, eax
cmp esi, 0x1000
jbe 0x10023eda
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [0x10063898]
mov byte [esi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
call fcn.10021ad0
call fcn.1001e250
call fcn.10021bc0
call fcn.10021720
call fcn.10021410
call fcn.100214b0
call fcn.10022910
call fcn.10022620
call fcn.10022b60
mov ecx, ebx
call fcn.100229a0
call fcn.10021dc0
call fcn.10022500
call fcn.100221a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c2e9
mov esp, ebp
pop ebp
ret