Function at 0x10001cf0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1008c880]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
push 0x10068364
push 0x10068378
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001be90
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x114]
add eax, 0xe
push eax
call fcn.10047b7f
add esp, 0xc
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x10001d85
call fcn.1004d172
xor edx, edx
or ecx, 0xffffffff
div ecx
mov dword [ebp - 0x120], edx
mov edx, dword [ebp - 0x120]
jmp edx
push 0x10068388
push 0x10068390
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001be90
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x114]
add edx, 9
push edx
call fcn.10047b7f
add esp, 0xc
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x10001e01
call fcn.1004d172
xor edx, edx
or ecx, 0xffffffff
div ecx
mov dword [ebp - 0x128], edx
mov edx, dword [ebp - 0x128]
jmp edx
push 0x1006839c
push 0x100683a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001be90
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x114]
add edx, 9
push edx
call fcn.10047b7f
add esp, 0xc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x10001e7d
call fcn.1004d172
xor edx, edx
or ecx, 0xffffffff
div ecx
mov dword [ebp - 0x130], edx
mov edx, dword [ebp - 0x130]
jmp edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
call fcn.10003f40
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x30], eax
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.1001be30
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100683b0
call fcn.10003f40
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x34], eax
mov ecx, str.DataPlayerPlayer.bmd
call fcn.10003f40
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x38], eax
mov ecx, str.DataLang.mpr
call fcn.10003f40
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x3c], eax
mov ecx, str.DataLocalServerInfo.bmd
call fcn.10003f40
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x40], eax
mov ecx, str.LiveGuard.dll
call fcn.10003f40
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x44], eax
push 0
push 0
push 0
push 0x10001ab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x28], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100463c8
mov esp, ebp
pop ebp
ret