Function at 0x71ccba10
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp ecx, 0xc
je 0x71ccbb4f
cmp ecx, 0x78
jne 0x71ccbc44
test dword [ebp + 0xc], 1
je 0x71ccbc44
cmp dword [edx + 8], 1
jbe 0x71ccbc44
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0xb
jne 0x71ccbc44
mov eax, dword [eax]
mov edi, dword [eax + 4]
test edi, edi
je 0x71ccbc44
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp eax, 0x100
jbe 0x71ccba85
cmp byte [edi], 0x4d
jne 0x71ccba8e
cmp byte [edi + 1], 0x5a
jne 0x71ccba8e
jmp 0x71ccbab5
cmp eax, 0x10
jbe 0x71ccbc44
mov ecx, edi
mov edx, 0x71d1b2d0
mov esi, 0xc
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x71ccbc44
add ecx, 4
add edx, 4
sub esi, 4
jae 0x71ccbaa0
mov ebx, dword [0x71d78d94]
mov esi, ebx
mov byte [ebp - 5], 0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x71ccbac4
mov eax, dword [0x71d77974]
sub esi, ecx
sar esi, 1
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x71ccbb27
push 0x71d776fc
push dword [0x71d77714]
lea ecx, [ebp - 5]
push dword [0x71d77710]
push 1
push 0x23
push dword [0x71d776ec]
push dword [0x71d776f0]
push dword [ebp - 0x10]
push edi
push esi
push ebx
push ecx
mov ecx, eax
call dword [0x71d122ac]
mov eax, dword [ebp - 0xc]
call eax
mov esi, eax
jmp 0x71ccbb2c
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebp - 5], 0
mov ecx, str.true
mov edx, str.false
cmove ecx, edx
sub eax, dword [ebp - 0x14]
push ecx
push esi
push eax
push ebx
jmp 0x71ccbc16
test eax, eax
je 0x71ccbc44
cmp dword [eax + 8], 0xb
jne 0x71ccbc44
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x71ccbc44
mov ebx, dword [eax]
cmp ebx, 0x100
jbe 0x71ccbc44
mov edi, dword [0x71d78d94]
mov esi, edi
mov byte [ebp - 5], 0
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x71ccbb90
mov eax, dword [0x71d77974]
sub esi, ecx
sar esi, 1
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x71ccbbf3
push 0x71d776fc
push dword [0x71d77714]
lea ecx, [ebp - 5]
push dword [0x71d77710]
push 1
push 0x23
push dword [0x71d776ec]
push dword [0x71d776f0]
push ebx
push dword [ebp - 0x14]
push esi
push edi
push ecx
mov ecx, eax
call dword [0x71d122ac]
mov eax, dword [ebp - 0xc]
call eax
mov esi, eax
jmp 0x71ccbbf8
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebp - 5], 0
mov ecx, str.true
mov edx, str.false
cmove ecx, edx
sub eax, dword [ebp - 0x10]
push ecx
push esi
push eax
push edi
push str.ScanScript_url:__s__took:__d__ms___result:_0x_08x__block_:__s
push 0x48f
push 0x71d1ae04
push 3
call fcn.71cec390
add esp, 0x20
cmp byte [ebp - 5], 0
je 0x71ccbc44
push 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret 8