Function at 0x11e0d020
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x11fb9d71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x444
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
xor esi, esi
mov ecx, 0x1212e6c0
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x2c], 1
call fcn.11e07910
mov ebp, eax
cmp ebp, esi
je 0x11e0d2e9
call ebx
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], eax
call fcn.11e08b40
lea ecx, [esp + 0x24]
mov dword [esp + 0x45c], esi
call fcn.11e08be0
test eax, eax
je 0x11e0d348
call ebx
mov edi, dword [ebp + 0x20c]
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
mov dword [esp + 0x45c], 0xffffffff
call fcn.11e08b90
cmp edi, esi
jne 0x11e0d27f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24e]
mov word [esp + 0x24c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46]
mov word [esp + 0x44], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x44]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x11e0d199
call ebx
lea ecx, [esp + 0x44]
mov dword [esp + 0x30], eax
push ecx
call fcn.11e67d05
add esp, 4
cmp eax, esi
jbe 0x11e0d14a
cmp word [esp + eax*2 + 0x42], 0x5c
lea eax, [esp + eax*2 + 0x42]
jne 0x11e0d14a
mov word [eax], si
lea edx, [esp + 0x44]
push 0x7e
push edx
call fcn.11e684ca
add esp, 8
test eax, eax
je 0x11e0d17f
lea eax, [esp + 0x24c]
push 0x104
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.11caf570
add esp, 0xc
call ebx
mov dword [esp + 0x40], eax
jmp 0x11e0d199
lea edx, [esp + 0x44]
push 0x103
lea eax, [esp + 0x250]
push edx
push eax
call fcn.11e674bf
add esp, 0xc
cmp dword [0x12133f80], esi
je 0x11e0d1c3
mov eax, dword [0x12126854]
lea ecx, [esp + 0x24c]
push ecx
push eax
push str.__s__CTSafeDocShareDataMgr::GetTempPathW_Path__s__r_n
push str.ExpandPath
push 1
call fcn.11ca5810
add esp, 0x14
call ebx
mov dword [esp + 0x10], eax
mov eax, dword [0x1212e6d4]
cmp eax, esi
jne 0x11e0d35e
call ebx
mov ecx, 0x1212b458
mov dword [esp + 0x38], eax
call fcn.11df5100
test eax, eax
jne 0x11e0d25b
call fcn.11e13cf0
test eax, eax
jne 0x11e0d25b
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x2c]
call fcn.11e08b40
mov esi, 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x45c], esi
call fcn.11e08be0
test eax, eax
je 0x11e0d37d
call ebx
mov dword [ebp + 0x20c], esi
lea edi, [ebp + 0x210]
mov ecx, 0x82
lea esi, [esp + 0x24c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x45c], 0xffffffff
call fcn.11e08b90
xor esi, esi
jmp 0x11e0d27f
lea edx, [esp + 0x24c]
push 0x104
push edx
push 0x1212e914
call fcn.11e674bf
add esp, 0xc
mov dword [esp + 0x2c], esi
call ebx
mov dword [esp + 0x18], eax
call ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x11e0d2e5
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x2c]
call fcn.11e08b40
lea ecx, [esp + 0x24]
mov dword [esp + 0x45c], 2
call fcn.11e08be0
test eax, eax
je 0x11e0d2d1
add ebp, 0x210
push 0x104
push ebp
push 0x1212e914
call fcn.11e674bf
add esp, 0xc
mov dword [esp + 0x45c], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.11e08b90
mov esi, dword [esp + 0x20]
call ebx
push 0x1212e914
mov edi, eax
call fcn.11e67d05
add esp, 4
test eax, eax
jne 0x11e0d31a
push str.GetUserAppDataPath
push str._c:UsersAppDataLocalTemp
push str._c:Documents_and_SettingsLocal_SettingsTemp
push 0x1212e914
call fcn.11e13120
add esp, 0x10
call ebx
cmp eax, dword [esp + 0x34]
jbe 0x11e0d487
mov ecx, dword [0x12133f80]
xor edx, edx
cmp ecx, edx
je 0x11e0d487
cmp eax, edx
je 0x11e0d391
cmp edi, edx
je 0x11e0d391
mov ecx, eax
sub ecx, edi
mov dword [esp + 0x2c], ecx
jmp 0x11e0d395
lea ecx, [esp + 0x24]
mov dword [esp + 0x45c], 0xffffffff
call fcn.11e08b90
jmp 0x11e0d2e9
lea eax, [esp + 0x24c]
push 0x104
push eax
push 0x1212e914
call fcn.11e674bf
add esp, 0xc
jmp 0x11e0d2e5
mov dword [esp + 0x45c], 0xffffffff
lea ecx, [esp + 0x24]
jmp 0x11e0d2e0
mov dword [esp + 0x2c], edx
cmp edi, edx
je 0x11e0d3a9
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
je 0x11e0d3a9
sub edi, ecx
mov dword [esp + 0x1c], edi
jmp 0x11e0d3ad
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x38]
cmp ecx, edx
je 0x11e0d3c5
mov edi, dword [esp + 0x14]
cmp edi, edx
je 0x11e0d3c5
sub edi, ecx
mov dword [esp + 0x14], edi
jmp 0x11e0d3c9
mov dword [esp + 0x14], edx
cmp ecx, edx
je 0x11e0d3dd
mov edi, dword [esp + 0x18]
cmp edi, edx
je 0x11e0d3dd
sub edi, ecx
mov dword [esp + 0x18], edi
jmp 0x11e0d3e1
mov dword [esp + 0x18], edx
mov edi, dword [esp + 0x10]
cmp edi, edx
je 0x11e0d3f5
cmp ecx, edx
je 0x11e0d3f5
sub ecx, edi
mov dword [esp + 0x10], ecx
jmp 0x11e0d3f9
mov dword [esp + 0x10], edx
cmp esi, edx
je 0x11e0d405
cmp edi, edx
je 0x11e0d405
sub edi, esi
jmp 0x11e0d407
xor edi, edi
mov ebx, dword [esp + 0x30]
cmp ebx, edx
je 0x11e0d41b
mov ebp, dword [esp + 0x40]
cmp ebp, edx
je 0x11e0d41b
sub ebp, ebx
jmp 0x11e0d41d
xor ebp, ebp
cmp esi, edx
je 0x11e0d429
cmp ebx, edx
je 0x11e0d429
sub ebx, esi
jmp 0x11e0d42b
xor ebx, ebx
mov ecx, dword [esp + 0x3c]
cmp ecx, edx
je 0x11e0d43b
cmp esi, edx
je 0x11e0d43b
sub esi, ecx
mov edx, esi
test eax, eax
je 0x11e0d447
test ecx, ecx
je 0x11e0d447
sub ecx, eax
jmp 0x11e0d449
xor ecx, ecx
mov esi, dword [esp + 0x2c]
push 0x1212e914
push esi
mov esi, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
push esi
push edi
push ebp
push ebx
mov ebx, dword [esp + 0x58]
push edx
sub eax, ebx
push ecx
push eax
push str.GetUserTempPath_t2_t1__lu__t3_t2__lu__t4_t3__lu__t5_t4__lu__t6_t5__lu__t7_t4__lu__t8_t7__lu__t9_t8__lu__t10_t8__lu__t12_t11__lu__t2_t12__lu__ret__s_
push str.ExpandPath
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x3c
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebp
mov eax, 0x1212e914
pop ebx
mov dword fs:[0], ecx
add esp, 0x450
ret