Function at 0x1024025
Capabilities:
Check for time delay via gettickcount
Create process memory minidump

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x103e010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x2d4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x308], ebx
lea edi, [ebp - 0x304]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x318], ebx
lea edi, [ebp - 0x314]
stosd dword es:[edi], eax
push 0x4c
stosd dword es:[edi], eax
lea eax, [ebp - 0x36c]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2dc], ebx
mov dword [ebp - 0x370], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x2f4]
push 0x2c8
mov dword [ebp - 0x2f8], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x2cc]
push ebx
push eax
mov dword [ebp - 0x2d0], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x2ec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
lea eax, [ebp - 0x2f0]
push eax
push dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x320], 0x10235be
mov dword [ebp - 0x2f0], 0xc
mov dword [ebp - 0x2e8], ebx
call fcn.01023db4
mov edi, eax
cmp edi, ebx
jge 0x102412b
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x20
jmp 0x1024394
push ebx
push ebx
lea eax, [ebp - 0x2f0]
push eax
push 0x104
add esi, 4
push esi
push 0x1004310
push ebx
lea eax, [ebp - 0x2dc]
push eax
call fcn.01016f84
mov edi, eax
cmp edi, ebx
jge 0x102417c
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x21
jmp 0x1024394
push ebx
push ebx
push 0x100000
lea eax, [ebp - 0x2d8]
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
jne 0x10241d9
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.0100968c
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x22
jmp 0x1024394
push dword [ebp - 0x2d4]
call dword [sym.imp.ntdll.dll_NtSuspendProcess]
mov esi, 0xc0000000
and eax, esi
cmp eax, esi
jne 0x1024217
mov eax, dword [section..data]
cmp eax, section..data
je 0x1024221
test byte [eax + 0x1c], 1
je 0x1024221
push edi
push 0x1004210
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x1024221
mov dword [ebp - 0x2e0], 1
cmp dword [ebp + 0xc], ebx
jne 0x1024268
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x2d4]
call sub.KERNEL32.dll_GetProcessId
push eax
call fcn.01023b7e
mov edi, eax
cmp edi, ebx
jge 0x1024268
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x24
jmp 0x1024394
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x370]
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x318]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01023a53
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
lea eax, [ebp - 0x320]
push eax
push ebx
lea eax, [ebp - 0x318]
push eax
push 0x1104
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d4]
call sub.KERNEL32.dll_GetProcessId
push eax
push dword [ebp - 0x2d4]
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x102430e
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.0100968c
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x25
jmp 0x1024394
cmp dword [ebp - 0x2e0], ebx
je 0x1024328
push dword [ebp - 0x2d4]
call dword [sym.imp.ntdll.dll_NtResumeProcess]
mov dword [ebp - 0x2e0], ebx
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
mov edi, dword [ebp - 0x2e4]
mov dword [edi + 0x214], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x2d8]
push ebx
push ebx
push 0xc
push dword [ebp - 0x2d4]
call dword [sym.imp.ntdll.dll_RtlCreateProcessReflection]
mov ecx, eax
and ecx, esi
cmp ecx, esi
jne 0x10243a4
or eax, 0x10000000
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push edi
push 0x1004210
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x102442e
push dword [ebp - 0x308]
push dword [ebp - 0x2d4]
call fcn.010234a5
test eax, eax
jne 0x10243e2
push 6
pop edi
mov eax, dword [section..data]
cmp eax, section..data
je 0x102442e
test byte [eax + 0x1c], 1
je 0x102442e
push 0x1004210
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
jmp 0x102442e
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x308]
mov dword [edi + 0x218], eax
mov dword [edi + 0x20c], ecx
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x102442c
test byte [ecx + 0x1c], 4
je 0x102442c
push eax
push dword [edi + 0x214]
push 0x1004210
push 0x28
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01023473
xor edi, edi
cmp dword [ebp - 0x2d8], ebx
je 0x1024447
push dword [ebp - 0x2d8]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x2d8], ebx
cmp dword [ebp - 0x2dc], ebx
je 0x1024460
push dword [ebp - 0x2dc]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x2dc], ebx
cmp dword [ebp - 0x304], ebx
je 0x1024479
push dword [ebp - 0x304]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x304], ebx
cmp dword [ebp - 0x2ec], ebx
je 0x1024492
push dword [ebp - 0x2ec]
call sub.KERNEL32.dll_LocalFree
mov dword [ebp - 0x2ec], ebx
cmp edi, ebx
jge 0x10244a1
mov ecx, dword [ebp - 0x2e4]
call fcn.0102357e
cmp dword [ebp - 0x2e0], ebx
je 0x10244b5
push dword [ebp - 0x2d4]
call dword [sym.imp.ntdll.dll_NtResumeProcess]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010084d5
leave
ret 0xc