Function at 0x102e27e
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077798
sub esp, 0x154
mov eax, dword [0x10de03c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], ebx
call fcn.01075ed8
mov ecx, dword [eax + 4]
call fcn.010584c0
mov edi, eax
mov dword [ebp - 0x5c], edi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [0x10e00f4], ebx
mov dword [0x10e2598], ebx
mov dword [0x10e00fc], ebx
mov byte [0x10e25c4], bl
mov byte [0x10e0210], bl
call fcn.01082132
movsx eax, word [ebp + 8]
xor esi, esi
inc esi
mov dword [0x10e00f8], ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [0x10e0114], eax
mov dword [0x10e010c], esi
call fcn.01021462
mov eax, dword [eax + 0x2b4]
push 3
cdq
pop ecx
idiv ecx
mov dword [0x10e259c], ebx
mov dword [0x10e20f4], esi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], ax
lea eax, [ebp - 0x4c]
push eax
call fcn.0102ada6
test eax, eax
jne 0x102e354
push esi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.0101726b
mov ecx, dword [eax + 0xd4]
call fcn.01075fb0
jmp 0x102edd0
cmp dword [ebp - 0x4c], ebx
je 0x102e378
push esi
call fcn.0101726b
mov ecx, dword [eax + 0xd4]
call fcn.01075fb0
push 4
pop eax
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], ax
jmp 0x102edd7
call fcn.0101726b
push edi
push ebx
push 0x401
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
push 0x80f8
call fcn.01064a77
call fcn.0104e8e8
test eax, eax
jne 0x102ec97
call fcn.01077c25
test ax, ax
je 0x102ec97
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x54], 0xa
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.01077d26
mov eax, dword [edi + 0x5c]
cmp eax, ebx
je 0x102e502
lea eax, [ebp - 0x20]
push eax
call fcn.01077c3f
test ax, ax
jne 0x102e507
call fcn.0104e918
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x44], ebx
call fcn.01081e43
cmp eax, ebx
mov dword [ebp - 0x48], eax
je 0x102e54a
cmp dword [ebp - 0x44], ebx
jne 0x102e45e
push dword [ebp - 0x48]
call fcn.01081e2f
cmp eax, ebx
mov dword [ebp - 0x44], eax
je 0x102e44f
mov edi, dword [ebp - 0x44]
push 4
add edi, 0x38
pop ecx
lea esi, [ebp - 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x102e44a
push dword [ebp - 0x44]
call fcn.01081e4e
cmp eax, ebx
mov dword [ebp - 0x44], eax
jne 0x102e429
cmp dword [ebp - 0x44], ebx
jne 0x102e45e
push dword [ebp - 0x48]
call fcn.01081e4e
cmp eax, ebx
mov dword [ebp - 0x48], eax
jne 0x102e415
cmp dword [ebp - 0x48], ebx
je 0x102e54a
cmp dword [ebp - 0x50], ebx
je 0x102e54a
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x50]
lea eax, [esi + 0x3c]
push eax
push dword [edi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x102e497
push edi
call fcn.0104e92d
inc dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
jmp 0x102e467
cmp edi, ebx
je 0x102e54a
push dword [ebp - 0x58]
call fcn.0104f141
add esi, 0x3c
push esi
lea ecx, [ebp - 0x4c]
call fcn.01075e3c
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
push eax
add ecx, 0x78
mov dword [ebp - 4], ebx
call fcn.01075e30
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.01075e24
push 0x50
push esi
call fcn.01021462
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
call fcn.01021462
mov word [eax + 0xa0], bx
call fcn.0104efb2
call fcn.01021462
mov word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 1
call fcn.0104fb9e
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x5c]
cmp eax, ebx
je 0x102e527
push 0xa
pop esi
call fcn.01075a13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x102e514
lea eax, [ebp - 0x20]
push eax
call fcn.01077c3f
test ax, ax
jne 0x102e764
lea eax, [ebp - 0x20]
push eax
call fcn.0107af5e
xor edi, edi
inc edi
jmp 0x102e6e9
xor esi, esi
inc esi
push esi
push ebx
push 0x30
push ebx
push 0x449
push 0x17
call fcn.01054be3
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e588
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010661f8
push esi
call fcn.0101726b
mov ecx, dword [eax + 0xd4]
call fcn.01075fb0
mov eax, esi
jmp 0x102edd7
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x5c], ebx
je 0x102e671
call fcn.01075a13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jg 0x102e6e0
push ebx
call fcn.01077c7d
call fcn.01021462
cmp word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x102e5e3
call fcn.0102f8ec
push edi
push ebx
call fcn.0107f46f
mov esi, eax
cmp esi, ebx
je 0x102eca4
call fcn.01075a13
cmp esi, 0x3e3
je 0x102e62b
push ebx
push ebx
push ebx
call fcn.01050ebf
push 0x1f4
push edi
push edi
push ebx
call fcn.01050ebf
push 0xd37
call fcn.010815f2
push 8
push ebx
call fcn.01050ebf
add esp, 0x28
call fcn.0101726b
cmp eax, ebx
je 0x102e640
mov ecx, dword [eax + 0xd4]
push edi
call fcn.01075fb0
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e66a
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010661f8
mov eax, edi
jmp 0x102edd7
lea eax, [ebp - 0x20]
push eax
call fcn.0107a8b4
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.01075e60
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], edi
call fcn.01075e60
push ebx
push esi
push 0x44a
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.01016fd5
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 3
call fcn.01054c69
cmp eax, edi
jne 0x102e6f7
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.010171f5
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075e24
lea eax, [ebp - 0x20]
push eax
call fcn.0107af5e
test ax, ax
je 0x102e5a0
jmp 0x102e5ca
push ebx
call fcn.01077c7d
push edi
call fcn.0101726b
mov ecx, dword [eax + 0xd4]
call fcn.01075fb0
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e738
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010661f8
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.010171f5
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075e24
jmp 0x102e66a
lea eax, [ebp - 0x40]
push eax
call fcn.0107aa61
push eax
mov dword [ebp - 0x44], eax
call fcn.0107dabb
test eax, eax
jne 0x102e823
lea eax, [ebp - 0x30]
push eax
call fcn.01079bd0
test ax, ax
je 0x102e823
push ebx
lea ecx, [ebp - 0xd8]
call fcn.010748dc
push ebx
mov dword [ebp - 4], 4
call fcn.0101726b
mov ecx, eax
call fcn.01075fb0
push ebx
push 0x4ef0
lea ecx, [ebp - 0xd8]
call fcn.01076910
push ebx
lea ecx, [ebp - 0xd8]
call fcn.01076610
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0xd8]
call fcn.0107628c
call fcn.01075a13
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
call fcn.01079d2b
test ax, ax
jne 0x102e7dc
lea ecx, [ebp - 0xd8]
call fcn.01075d28
push edi
call fcn.0101726b
mov ecx, eax
call fcn.01075fb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.01075e18
jmp 0x102ebb2
xor edi, edi
inc edi
jmp 0x102ebb2
mov esi, dword [ebp - 0x5c]
cmp dword [esi + 0x5c], ebx
je 0x102e84a
call fcn.01021462
mov eax, dword [eax + 0xb90]
test byte [eax + 0x9f], 1
mov dword [ebp - 0x48], edi
jne 0x102e84d
mov dword [ebp - 0x48], ebx
mov eax, dword [esi + 0x5c]
cmp eax, ebx
mov dword [ebp - 0x4c], eax
je 0x102e87a
cmp dword [ebp - 0x48], ebx
jne 0x102e87a
call fcn.01075a13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jle 0x102e5ca
push dword [ebp - 0x44]
call fcn.0107ca68
mov esi, eax
cmp esi, ebx
je 0x102e9b1
lea ecx, [ebp - 0x74]
call fcn.01075e60
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 5
call fcn.01075e60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075e60
push 0x44c
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.01075e90
push 0x64
push 0x64
lea ecx, [ebp - 0x68]
call fcn.01076304
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010792f9
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
call fcn.010762f8
push dword [ebp - 0x68]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.01075e84
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102e923
cmp dword [ebp - 0x4c], ebx
je 0x102e90e
lea eax, [esi + 0x14]
push eax
call fcn.0107b019
test ax, ax
je 0x102e923
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x74]
push 0x17
call fcn.01054b83
cmp eax, 6
jne 0x102e98d
push esi
call fcn.0107e3be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
jmp 0x102e94f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x493e0
jae 0x102e95b
call fcn.01075a13
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x44]
call fcn.0107dabb
test eax, eax
je 0x102e933
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x493e0
jb 0x102ebc7
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x5c], ebx
jne 0x102e98d
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push 0xfad
push 0x17
call fcn.01054be3
cmp eax, 6
je 0x102e929
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075e24
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.01075e24
push dword [ebp - 0x44]
call fcn.0107cae1
mov esi, eax
cmp esi, ebx
je 0x102ea78
lea ecx, [ebp - 0x70]
call fcn.01075e60
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 8
call fcn.01075e60
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075e60
push 0x44d
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.01075e90
push 0x64
push 0x64
lea ecx, [ebp - 0x64]
call fcn.01076304
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010792f9
push 0xffffffffffffffff
lea ecx, [ebp - 0x64]
call fcn.010762f8
push dword [ebp - 0x64]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
call fcn.01075e84
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102ebe4
cmp dword [ebp - 0x4c], ebx
jne 0x102ea54
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x70]
push 0x17
call fcn.01054b83
cmp eax, 6
je 0x102ebe4
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075e24
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.01075e24
push dword [ebp - 0x44]
call fcn.0107cb5a
mov esi, eax
cmp esi, ebx
je 0x102eb51
lea eax, [esi + 0x14]
push eax
call fcn.0107b019
test ax, ax
jne 0x102eb51
lea ecx, [ebp - 0x50]
call fcn.01075e60
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], LoadLibraryW
call fcn.01075e60
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075e60
push 0x44e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], LoadLibraryW
call fcn.01075e90
push 0x64
push 0x64
lea ecx, [ebp - 0x60]
call fcn.01076304
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010792f9
push 0xffffffffffffffff
lea ecx, [ebp - 0x60]
call fcn.010762f8
push dword [ebp - 0x60]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x50]
push eax
call fcn.01075e84
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102ec10
cmp dword [ebp - 0x4c], ebx
jne 0x102eb2d
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x50]
push 0x17
call fcn.01054b83
cmp eax, 6
je 0x102ec10
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075e24
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.01075e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075e24
cmp dword [ebp - 0x48], ebx
je 0x102eb76
call fcn.01075a13
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jle 0x102e5ca
jmp 0x102ebb2
push ebx
push ebx
push 0x44b
lea ecx, [ebp - 0x160]
call fcn.01016fd5
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 4], LoadLibraryW
call fcn.01054c69
cmp eax, edi
jne 0x102ec42
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.010171f5
push dword [ebp - 0x44]
call fcn.0107dabb
test eax, eax
je 0x102e82b
jmp 0x102e5ca
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075e24
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.01075e24
lea ecx, [ebp - 0x74]
jmp 0x102ec34
push esi
call fcn.0107c950
add esi, 0x14
push esi
call fcn.01077cfc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075e24
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.01075e24
lea ecx, [ebp - 0x70]
jmp 0x102ec34
add esi, 0x14
push esi
call fcn.01077cfc
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075e24
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.01075e24
lea ecx, [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
call fcn.01075e24
jmp 0x102e5ca
push ebx
call fcn.01077c7d
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102ec72
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010661f8
push edi
call fcn.0101726b
mov ecx, dword [eax + 0xd4]
call fcn.01075fb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.010171f5
jmp 0x102e66a
call fcn.01075a13
call fcn.0104fb9e
xor edi, edi
inc edi
mov eax, dword [0x10e25b4]
mov esi, dword [eax + 4]
jmp 0x102eccc
mov eax, dword [0x10e25bc]
mov dword [esi + 0x98], eax
call fcn.0104e8e8
test eax, eax
je 0x102ecc9
or byte [esi + 0xa0], 8
mov esi, dword [esi + 4]
cmp esi, ebx
jne 0x102ecae
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.0103220e
call fcn.0102e107
cmp dword [0x10e01fc], ebx
je 0x102ed12
push ebx
push ebx
push ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01050ebf
push reloc.KERNEL32.dll_GetProcessHeap
push edi
push edi
push ebx
call fcn.01050ebf
push 8
push ebx
call fcn.01050ebf
add esp, 0x24
mov ecx, dword [ebp - 0x5c]
call fcn.010744f8
test eax, eax
je 0x102ed33
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], di
jne 0x102ed6f
mov ecx, dword [ebp - 0x5c]
call fcn.010744f8
test eax, eax
je 0x102ed6f
mov ecx, dword [ebp - 0x5c]
push ebx
call fcn.0102aacf
call fcn.01075ed8
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
xor ecx, ecx
mov cx, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, dword [eax + 0xc4]
call fcn.010661f8
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x102ed6f
call fcn.0104ec4f
call fcn.0107aece
push dword [0x10e00f8]
call fcn.010845e3
mov dword [0x10e20f4], ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
call fcn.0107f017
call fcn.0108b74d
call fcn.0101726b
mov eax, dword [eax + 0xd4]
mov ecx, dword [eax + 0x88]
add ecx, 0x388
call fcn.0101ee66
push 0x10e0218
call fcn.01024be1
push 0x10e021c
call fcn.01024be1
push 0x10e0220
call fcn.01024be1
call fcn.01082132
movsx eax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075aef
leave
ret 4