Function at 0x1000ff40
Capabilities:
Check for time delay via gettickcount
Get hostname
Query or enumerate registry value

Disassembly:
sub esp, 0x258
mov eax, dword [0x10054020]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
mov ebp, dword [esp + 0x264]
push esi
xor esi, esi
cmp dword [ebp + 0x74], esi
push edi
jne 0x100100a5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov eax, 0x51eb851f
mul esi
shr edx, 5
imul edx, edx, 0x64
mov eax, esi
sub eax, edx
mov ebx, esi
je 0x1000ffcb
call edi
mov esi, eax
mov ecx, esi
sub ecx, ebx
cmp ecx, 0x1388
ja 0x1000ffcb
lea esp, [esp]
mov eax, 0x51eb851f
mul esi
shr edx, 5
imul edx, edx, 0x64
mov eax, esi
sub eax, edx
je 0x1000ffcb
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov esi, eax
mov ecx, esi
sub ecx, ebx
cmp ecx, 0x1388
jbe 0x1000ffa0
lea edx, [esp + 0x10]
xor edi, edi
push edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCR80.dll__time64]
mov ecx, dword [esp + 0x18]
mov eax, 0x10624dd3
mul esi
shr edx, 6
imul edx, edx, 0x3e8
add esp, 4
push edi
mov eax, esi
sub eax, edx
mov edx, dword [esp + 0x14]
push 0x3e8
mov ebx, eax
push ecx
xor eax, eax
push edx
mov dword [esp + 0x2c], eax
call fcn.1003fb20
add ebx, eax
mov eax, dword [esp + 0x1c]
adc eax, edx
xor ecx, ecx
push ecx
sub ebx, esi
push 0x3e8
sbb eax, ecx
push eax
push ebx
call fcn.1003fc40
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.MSVCR80.dll__localtime64_s]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x4c]
push ecx
add edx, 1
push edx
add eax, 0x76c
push eax
push str._04d_02d_02d_02d_02d_02d
lea ecx, [ebp + 0x60]
call fcn.10022b50
add esp, 0x24
xor esi, esi
cmp dword [ebp + 0x90], esi
jne 0x10010180
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [esp + 0x34], esi
mov dword [esp + 0x24], 4
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10010107
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push esi
push esi
push str.InstallDate
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], eax
xor eax, eax
push ecx
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x54], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
call dword [sym.imp.MSVCR80.dll__localtime64_s]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push eax
add ecx, 1
push ecx
add edx, 0x76c
push edx
push str._04d_02d_02d_02d_02d_02d
lea ecx, [ebp + 0x7c]
call fcn.10022b50
add esp, 0x24
cmp dword [ebp + 0xac], esi
jne 0x10010205
push 0x208
lea eax, [esp + 0x56]
push esi
push eax
mov word [esp + 0x5c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x54]
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x50]
mov word [esp + 0x256], si
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x100101c7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x54]
lea esi, [ebp + 0x98]
push eax
call fcn.100025e0
push str.__r_t_n
mov eax, esi
call fcn.100228c0
add esp, 4
push str.__r_t_n
mov eax, esi
call fcn.10022930
add esp, 4
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003ec9d
add esp, 0x258
ret 4