Function at 0x1000ebc0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100199c8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10023018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, 0x1001d1e4
lea esi, [ebp - 0x28]
sub edi, 0x6b3bee31
call fcn.10015f70
cmp dword [0x1011fcfc], 0
je 0x1000ec38
mov dword [ebp - 4], 0
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 4
push esi
call ebx
push 4
push 0x1001e2a8
jmp 0x1000ec67
mov dword [ebp - 4], 1
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 4
push esi
call ebx
push 4
push 0x1001e2b0
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x74]
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push eax
push 4
push esi
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, 0x7d6a37b7
lea esi, [ebp - 0x28]
call fcn.10015ff0
cmp dword [0x1011fd00], 0
je 0x1000eccf
mov dword [ebp - 4], 2
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 5
push esi
call ebx
push 5
push 0x1001e2b8
jmp 0x1000ecf8
mov dword [ebp - 4], 3
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 5
push esi
call ebx
push 5
push 0x1001e2c0
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x74]
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push eax
push 5
push esi
call ebx
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, 0x1001e2d0
lea esi, [ebp - 0x48]
sub edi, 0x4a53b15a
call fcn.10016460
cmp dword [0x1011fcb4], 0
je 0x1000ed66
mov dword [ebp - 4], 4
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 5
push esi
call ebx
push 5
push 0x1001e2c8
jmp 0x1000ed8f
mov dword [ebp - 4], 5
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 5
push esi
call ebx
push 5
push 0x1001e2c0
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x74]
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push eax
push 5
push esi
call ebx
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fbf4], 0
je 0x1000ee32
mov edi, str._9__860__87_9__
sub edi, 0x6fad512a
lea esi, [ebp - 0x54]
call fcn.100164a0
mov dword [ebp - 4], 6
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
fld dword [0x1001ed38]
mov ecx, dword [eax]
mov edi, 0x1001e318
fstp dword [ecx]
sub edi, 0x16440e0f
lea esi, [ebp - 0x54]
call fcn.100164e0
mov dword [ebp - 4], 7
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
fld dword [0x1001ed34]
mov ecx, dword [eax]
fstp dword [ecx + 4]
mov dword [ebp - 4], 0xffffffff
mov edi, 1
cmp dword [0x1011fbd4], edi
jne 0x1000eef4
lea esi, [edi + 0x1f]
call fcn.10001850
lea esi, [ebp - 0x48]
test al, 1
je 0x1000ee8d
mov edi, str._lco
sub edi, 0x1e7b41dd
call fcn.100160f0
mov dword [ebp - 4], 8
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 3
push esi
call ebx
push 3
push 0x1001e344
jmp 0x1000eec6
mov edi, str.__2_4
sub edi, 0x6fad512a
call fcn.10016520
mov dword [ebp - 4], 9
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 3
push esi
call ebx
push 3
push 0x1001e348
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x74]
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push eax
push 3
push esi
call ebx
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fbd4], 0
jne 0x1000ef67
mov edi, str.__2_4
sub edi, 0x6fad512a
lea esi, [ebp - 0x48]
call fcn.10016520
mov dword [ebp - 4], 0xa
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
lea ecx, [ebp - 0x74]
push ecx
push 0x40
mov esi, eax
push 3
push esi
call ebx
push 3
push 0x1001e348
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x74]
add esp, 0xc
lea edx, [ebp - 0x78]
push edx
push eax
push 3
push esi
call ebx
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fc40], 0
je 0x1000ef99
call fcn.10008470
push eax
call fcn.100083e0
push eax
call fcn.10008470
push eax
call fcn.10008340
cmp byte [eax], 0
je 0x1000ef99
lea esp, [esp]
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x1000ef90
cmp dword [0x1011fc1c], 0
je 0x1000efca
call fcn.10008470
push eax
call fcn.100083e0
push eax
call fcn.10008470
push eax
call fcn.10008340
mov ecx, dword [str.0104087]
mov dword [eax], ecx
mov edx, dword [0x1001e370]
mov dword [eax + 4], edx
cmp dword [0x1011fcd8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x1000f0a9
xor edi, edi
lea esi, [edi + 1]
call fcn.10001850
test eax, eax
je 0x1000eff8
call ebx
mov dword [0x101200ec], eax
mov dword [0x101200f8], esi
call ebx
mov ecx, dword [0x101200ec]
add ecx, 0x32
cmp eax, ecx
jbe 0x1000f02b
cmp dword [0x101200f8], esi
jne 0x1000f02b
push 1
push 4
push 0x33
call fcn.100175f0
call ebx
mov dword [0x101200f0], eax
mov dword [0x101200f8], 2
call ebx
mov edx, dword [0x101200f0]
add edx, 0x32
cmp eax, edx
jbe 0x1000f075
cmp dword [0x101200f8], 2
jne 0x1000f075
push 3
push 4
push 0x33
call fcn.100175f0
push 3
push 0x21
push 0x46
call fcn.100175f0
push 1
push 2
push 0x31
call fcn.100175f0
call ebx
mov dword [0x101200f4], eax
mov dword [0x101200f8], 3
call ebx
mov ecx, dword [0x101200f4]
add ecx, 0x23
cmp eax, ecx
jbe 0x1000f0a9
cmp dword [0x101200f8], 3
jne 0x1000f0a9
push 3
push 2
push 0x31
call fcn.100175f0
push 3
push 0x21
push 0x46
call fcn.100175f0
mov dword [0x101200f8], edi
cmp dword [0x1011fcc8], 0
jne 0x1000f0f9
call fcn.10008470
push eax
call fcn.100083e0
push eax
call fcn.10008ff0
add esp, 4
push eax
call fcn.10008aa0
test eax, eax
je 0x1000f0f9
mov edi, 0x1021ecfa
lea esi, [ebp - 0x28]
call fcn.10015f30
mov dword [ebp - 4], 0xb
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fcc8], 1
jne 0x1000f165
call fcn.10008470
push eax
call fcn.100083e0
push eax
call fcn.10008ff0
add esp, 4
push eax
call fcn.10008aa0
mov dword [ebp - 0x74], eax
test eax, eax
je 0x1000f165
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x80000001
jne 0x1000f165
mov edi, 0x1021ecfa
lea esi, [ebp - 0x28]
call fcn.10015f30
mov dword [ebp - 4], 0xc
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
fld dword [0x1001ed30]
mov ecx, dword [ebp - 0x74]
fstp dword [eax + ecx]
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fcc8], 2
jne 0x1000f1c2
call fcn.10008470
push eax
call fcn.100083e0
push eax
call fcn.10008ff0
add esp, 4
push eax
call fcn.10008aa0
mov dword [ebp - 0x74], eax
test eax, eax
je 0x1000f1c2
mov edi, 0x1021ecfa
lea esi, [ebp - 0x28]
call fcn.10015f30
mov dword [ebp - 4], 0xd
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x74]
mov dword [eax + ecx], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1011fc9c], 0
je 0x1000f2b1
xor edi, edi
lea esi, [edi + 1]
call fcn.10001850
test eax, eax
je 0x1000f1ea
call ebx
mov dword [0x101200fc], eax
mov dword [0x10120108], esi
call ebx
mov edx, dword [0x101200fc]
add edx, 0x32
cmp eax, edx
jbe 0x1000f228
cmp dword [0x10120108], esi
jne 0x1000f228
push 1
push 4
push 0x33
call fcn.100175f0
push 1
push 0x21
push 0x46
call fcn.100175f0
call ebx
mov dword [0x10120100], eax
mov dword [0x10120108], 2
call ebx
mov ecx, dword [0x10120100]
add ecx, 0x32
cmp eax, ecx
jbe 0x1000f27d
cmp dword [0x10120108], 2
jne 0x1000f27d
push 3
push 4
push 0x33
call fcn.100175f0
push 3
push 0x21
push 0x46
call fcn.100175f0
push 1
push 2
push 0x31
call fcn.100175f0
push 1
push 0x21
push 0x46
call fcn.100175f0
call ebx
mov dword [0x10120104], eax
mov dword [0x10120108], 3
call ebx
mov edx, dword [0x10120104]
add edx, 0x23
cmp eax, edx
jbe 0x1000f2b1
cmp dword [0x10120108], 3
jne 0x1000f2b1
push 3
push 2
push 0x31
call fcn.100175f0
push 3
push 0x21
push 0x46
call fcn.100175f0
mov dword [0x10120108], edi
cmp dword [0x1011fc18], 0
je 0x1000f530
fld dword [0x1001ed2c]
sub esp, 8
fstp dword [esp + 4]
call fcn.10008470
push eax
call fcn.100083e0
add esp, 4
push eax
call fcn.10008ff0
add esp, 4
push eax
call fcn.10008ec0
test al, al
jne 0x1000f489
call ebx
cmp dword [0x1011fee0], eax
ja 0x1000f3d0
push 0
push 0x85
push 0x34
call fcn.100175f0
call fcn.100086e0
push eax
call fcn.10008650
push eax
push ecx
call fcn.100086e0
push eax
call fcn.100085c0
add esp, 4
push eax
push 1
call fcn.10017640
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10016130
mov dword [ebp - 0x74], eax
mov edi, 0x1023f264
lea esi, [ebp - 0x70]
mov dword [ebp - 4], 0xe
call fcn.10015eb0
mov dword [ebp - 0x78], eax
lea esi, [ebp - 0x44]
call fcn.10015eb0
mov edi, eax
mov byte [ebp - 4], 0x10
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x74]
mov eax, dword [eax + 0x28]
push edx
call eax
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x78]
push eax
call edx
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x74]
add esi, dword [eax]
mov eax, dword [edx + 0x28]
push edi
call eax
mov ecx, dword [esi]
mov edx, dword [eax + ecx]
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
call ebx
add eax, 0xfa0
mov dword [0x1011fee0], eax
jmp 0x1000f489
push 2
push 0x85
push 0x28
call fcn.100175f0
call fcn.100086e0
push eax
call fcn.10008650
push eax
push ecx
call fcn.100086e0
push eax
call fcn.100085c0
add esp, 4
push eax
push 1
call fcn.10017640
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10016130
mov ebx, eax
mov edi, 0x1023f264
lea esi, [ebp - 0x44]
mov dword [ebp - 4], 0x11
call fcn.10015eb0
mov dword [ebp - 0x78], eax
lea esi, [ebp - 0x70]
call fcn.10015eb0
mov edi, eax
mov byte [ebp - 4], 0x13
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push ebx
call edx
mov ecx, dword [0x1011f940]
mov edx, dword [ebp - 0x78]
mov ebx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
push edx
call eax
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [edx + 0x28]
add esi, dword [ebx]
push edi
call eax
mov ecx, dword [esi]
mov edx, dword [eax + ecx]
mov dword [edx + 0x68], 0
mov dword [ebp - 4], 0xffffffff
fld dword [0x1001ed2c]
sub esp, 8
fstp dword [esp + 4]
call fcn.10008470
push eax
call fcn.100083e0
add esp, 4
push eax
call fcn.10008ff0
add esp, 4
push eax
call fcn.10008ec0
test al, al
je 0x1000f530
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10016130
mov ebx, eax
mov edi, 0x1023f264
lea esi, [ebp - 0x44]
mov dword [ebp - 4], 0x14
call fcn.10015eb0
mov dword [ebp - 0x78], eax
lea esi, [ebp - 0x70]
call fcn.10015eb0
mov edi, eax
mov byte [ebp - 4], 0x16
mov ecx, dword [0x1011f940]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push ebx
call edx
mov ecx, dword [0x1011f940]
mov edx, dword [ebp - 0x78]
mov ebx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
push edx
call eax
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [edx + 0x28]
add esi, dword [ebx]
push edi
call eax
mov ecx, dword [esi]
mov edx, dword [eax + ecx]
mov dword [edx + 0x68], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017c55
mov esp, ebp
pop ebp
ret