Function at 0x10002000
Capabilities:
Check for time delay via gettickcount
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1008a884]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
push 0x10066364
push 0x10066378
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001c540
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x114]
add eax, 0xe
push eax
call fcn.100487af
add esp, 0xc
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x1000208b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10066388
push 0x10066390
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001c540
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 9
push ecx
call fcn.100487af
add esp, 0xc
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x100020fd
push 0x3e9
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1006639c
push 0x100663a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.1001c540
add esp, 8
mov dword [ebp - 0x118], eax
push 0
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 5
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x114]
add edx, 9
push edx
call fcn.100487af
add esp, 0xc
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x1000216f
push 0x3ea
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
call fcn.10004260
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x30], eax
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.1001c520
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100663b0
call fcn.10004260
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x34], eax
mov ecx, str.DataPlayerPlayer.bmd
call fcn.10004260
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x38], eax
mov ecx, str.DataLang.mpr
call fcn.10004260
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x3c], eax
mov ecx, str.DataLocalServerInfo.bmd
call fcn.10004260
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x40], eax
mov ecx, str.LiveGuard.dll
call fcn.10004260
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x44], eax
push 0
push 0
push 0
push 0x10001bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x14], eax
push 0
push 0
push 0
push 0x10001e10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10046da7
mov esp, ebp
pop ebp
ret