Function at 0x1002bbc1
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
cmp byte [0x100e2e70], bl
mov edi, ecx
mov dword [esp + 0x1c], edi
mov ebp, 0x100e3108
mov esi, str.MAIN_DBG:_d_r_n
je 0x1002bbf1
push 0x26ba
push esi
push ebp
call fcn.10011029
add esp, 0xc
test byte [0x100e6003], 0x20
je 0x1002bc14
push ebx
push ebx
push 0x44a
push dword [0x100e12fc]
call fcn.100125e9
pop ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x100e2e70], bl
je 0x1002bc2b
push 0x26c0
push esi
push ebp
call fcn.10011029
add esp, 0xc
push ebx
push ebx
push 0x44a
push dword [0x100e2fc4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x100e2e70], bl
je 0x1002bc55
push 0x26c2
push esi
push ebp
call fcn.10011029
add esp, 0xc
cmp byte [0x100e6001], bl
je 0x1002bc71
cmp byte [0x100e6002], bl
jne 0x1002bc71
mov byte [0x100e6002], 1
call fcn.10021ce0
cmp byte [0x100e2e70], bl
je 0x1002bc88
push 0x26c4
push esi
push ebp
call fcn.10011029
add esp, 0xc
mov eax, dword [0x100e30e0]
cmp eax, ebx
je 0x1002bc96
cmp word [eax], bx
jne 0x1002bd04
push ebx
mov ecx, edi
call fcn.10018dc5
cmp byte [0x100e2e70], bl
je 0x1002bcc6
push dword [0x100e30e0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x26c8
push str.MAIN_DBG:_d__u_MyShell__s__r_n
push ebp
call fcn.10011029
add esp, 0x14
mov eax, dword [0x100e30e0]
cmp eax, ebx
je 0x1002bcd4
cmp word [eax], bx
jne 0x1002bcdf
push ebx
push ebx
push 0x64
mov ecx, edi
call fcn.10011621
cmp byte [0x100e2fb4], bl
je 0x1002bc88
cmp byte [0x100e3960], bl
jne 0x1002bc88
push ebx
push ebx
push 0x44b
push dword [0x100e2fc4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1002bc88
cmp byte [0x100e2e70], bl
je 0x1002bd1b
push 0x26ce
push esi
push ebp
call fcn.10011029
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 1
push 0xa
call edi
call fcn.100195a8
cmp byte [0x100e6001], bl
je 0x1002bd48
cmp byte [0x100e6002], bl
jne 0x1002bd48
mov byte [0x100e6002], 1
call fcn.10021ce0
push dword [0x100e30e0]
lea ecx, [esp + 0x18]
call fcn.100501eb
push dword [esp + 0x14]
call fcn.10021cf9
mov esi, eax
call fcn.10019577
push esi
call fcn.10010ea5
pop ecx
pop ecx
push 1
push 0xa
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esp + 0x14]
cmp word [eax], bx
mov byte [esp + 0x13], 2
je 0x1002c0a5
cmp byte [0x100e2e70], bl
mov edi, str.MAIN_DBG:_d_r_n
je 0x1002bda7
push 0x26e9
push edi
push ebp
call fcn.10011029
add esp, 0xc
call fcn.1001903b
test eax, eax
jne 0x1002c076
cmp byte [0x100e2e70], bl
je 0x1002bdcb
push 0x26eb
push edi
push ebp
call fcn.10011029
add esp, 0xc
cmp byte [0x100e2fb4], bl
je 0x1002bdee
cmp byte [0x100e3960], bl
jne 0x1002bdee
push ebx
push ebx
push 0x44b
push dword [0x100e2fc4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
cmp word [eax], bx
je 0x1002c076
cmp byte [0x100e2e70], bl
je 0x1002be12
push 0x26ee
push edi
push ebp
call fcn.10011029
add esp, 0xc
push dword [esp + 0x20]
call fcn.1000fc3e
mov esi, eax
push 8
push esi
push str.Explorer
call fcn.10040df5
add esp, 0x10
test al, al
je 0x1002be40
mov ax, word [esi + 0x10]
cmp ax, 0x2e
je 0x1002be42
cmp ax, bx
je 0x1002be42
xor esi, esi
cmp byte [0x100e2e70], bl
je 0x1002be59
push 0x26f0
push edi
push ebp
call fcn.10011029
add esp, 0xc
test byte [0x100e6003], 0x80
jne 0x1002c076
cmp esi, ebx
je 0x1002be7f
push ebx
push ebx
push ebx
push ebx
push esi
call fcn.10018574
add esp, 0x14
test eax, eax
jne 0x1002c076
call fcn.1001247b
cmp byte [0x100e2e70], bl
je 0x1002be9b
push 0x26f3
push edi
push ebp
call fcn.10011029
add esp, 0xc
push ebx
push ebx
push 0x44a
push dword [0x100e2fc4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x100e2e70], bl
je 0x1002bec5
push 0x26f5
push edi
push ebp
call fcn.10011029
add esp, 0xc
mov eax, 0x100c6a64
push eax
push eax
call sym.PECMD.DLL_LoadEnvi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
call esi
push dword [esp + 0x14]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], eax
call fcn.100501eb
push dword [esp + 0x18]
call fcn.10012569
cmp byte [0x100e2e70], bl
pop ecx
mov dword [esp + 0x24], eax
je 0x1002bf37
push 0x26fc
push edi
push ebp
call fcn.10011029
add esp, 0xc
cmp byte [0x100e2e70], bl
je 0x1002bf37
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x26fd
push str.MAIN_DBG:_d__u_MyShell__s__r_n
push ebp
call fcn.10011029
add esp, 0x14
cmp byte [esp + 0x13], 2
mov eax, 0x100cb428
jl 0x1002bf48
mov eax, 0x100ca904
push eax
push str.BeforeStart
call fcn.1002badc
cmp dword [esp + 0x2c], ebx
mov al, byte [esp + 0x1b]
pop ecx
pop ecx
push ebx
push ebx
mov byte [0x100e3054], al
push ebx
je 0x1002bf78
mov edi, dword [esp + 0x28]
push dword [esp + 0x24]
mov ecx, edi
call fcn.10034bed
jmp 0x1002bf99
mov ecx, dword [esp + 0x28]
push 7
lea eax, [esp + 0x34]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x40], 0x5e
call fcn.1000a5c9
mov edi, dword [esp + 0x1c]
push 0x100cb428
push str.AfterTerm
mov byte [0x100e3054], bl
call fcn.1002badc
cmp byte [esp + 0x1b], 1
pop ecx
pop ecx
jle 0x1002bfbb
dec byte [esp + 0x13]
call esi
sub eax, dword [esp + 0x28]
cmp eax, 0x7d0
jae 0x1002bff4
push ebx
push ebx
push 0x1f4
jmp 0x1002bfed
mov cx, word [eax]
cmp cx, bx
je 0x1002c068
cmp cx, 0x2a
jne 0x1002c007
cmp word [eax + 2], bx
jne 0x1002c007
push ebx
push ebx
push 0x64
mov ecx, edi
call fcn.10011621
mov ecx, edi
push ebx
call fcn.10018dc5
mov eax, dword [0x100e30e0]
cmp eax, ebx
jne 0x1002bfd1
jmp 0x1002c068
push eax
lea ecx, [esp + 0x18]
call fcn.1005026c
cmp byte [0x100e2e70], bl
je 0x1002c030
push dword [esp + 0x14]
push 0x270b
push str.MAIN_DBG:_d_MyShell__s__r_n
push ebp
call fcn.10011029
add esp, 0x10
push dword [esp + 0x14]
call fcn.10021cf9
mov esi, eax
call fcn.10019577
push esi
call fcn.10010ea5
cmp byte [0x100e2e70], bl
pop ecx
pop ecx
mov dword [esp + 0x20], eax
je 0x1002c068
push eax
push 0x270f
push str.MAIN_DBG:_d_ShellName__s__r_n
push ebp
call fcn.10011029
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.1003f96c
jmp 0x1002bd8b
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push 0x1f4
call fcn.10011621
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
call fcn.10018dc5
push dword [0x100e30e0]
lea ecx, [esp + 0x18]
call fcn.1005026c
jmp 0x1002bd8b
lea ecx, [esp + 0x14]
call fcn.1003f96c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4