Function at 0x10003e47
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x2c98]
mov eax, 0x2e44
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x2c94], eax
cmp byte [ecx + 0x1219], 0
mov eax, dword [ebp + 0x2ca4]
push ebx
push esi
push edi
mov dword [ebp + 0x70], ecx
mov dword [ebp + 0x68], eax
je 0x100044e0
xor ebx, ebx
cmp dword [0x1015668c], ebx
je 0x10003e99
push str.GetPackFileName_start
push ebx
call fcn.100412e2
pop ecx
pop ecx
test dword [0x1015787c], 0x200
mov esi, dword [0x101580a8]
je 0x10003ec0
cmp esi, ebx
je 0x10003ec0
mov eax, dword [ebp + 0x70]
mov byte [eax + 0x1218], 1
xor al, al
jmp 0x100044e2
push 0x80
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.10045030
add esp, 0xc
cmp esi, ebx
je 0x10003edf
mov al, byte [ebp + 0x2ca8]
jmp 0x10003ee9
mov eax, dword [ebp + 0x70]
movzx eax, byte [eax + 0x121b]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x10189098
call fcn.1002bcbe
mov edi, eax
mov dword [ebp + 0x80], edi
cmp edi, ebx
je 0x10003eb9
cmp dword [0x1015668c], ebx
je 0x10003f69
test byte [0x10150600], 1
je 0x10003f52
xor esi, esi
mov ecx, dword [ebp + esi*4 - 0x1c]
cmp ecx, 0xffffffff
je 0x10003f69
mov eax, ecx
imul eax, eax, 0x1210
push dword [eax + 0x1018989c]
lea eax, [eax + 0x1018969c]
push eax
push ecx
push esi
push edi
push str.GetPackFileName_List:count__d_ii__d_List__d___s___d_
push ebx
call fcn.100412e2
add esp, 0x1c
inc esi
cmp esi, 0x20
jl 0x10003f1b
jmp 0x10003f69
cmp edi, 1
je 0x10003f69
push dword [ebp + 0x6c]
push edi
push str.GetPackFileName_:_s___d
push ebx
call fcn.100412e2
add esp, 0x10
mov esi, str.test
lea edi, [ebp + 0x84]
movsd dword es:[edi], dword [esi]
push 0x27fb
lea eax, [ebp + 0x89]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.10045030
add esp, 0xc
cmp dword [0x101580c0], 0
mov ebx, 0x10155c28
mov edi, str.SoftWareTrojanCut_tc_MultiX
mov esi, reloc.WS2_32.dll_bind
je 0x10003fdd
push ebx
lea eax, [ebp + 0x2b90]
push 0x1006156c
push eax
call fcn.10045378
push 0x5b6a7988
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.10040ccf
mov dword [0x100784a8], eax
lea eax, [ebp + 0x84]
add esp, 0x1c
mov dword [ebp + 0x80], eax
mov eax, dword [ebp + 0x70]
cmp byte [eax + 5], 0
mov byte [eax + 4], 1
jne 0x100044e0
xor eax, eax
cmp byte [ebp + 0x2ca0], al
sete al
add eax, 5
cmp byte [0x101adb18], 0
mov dword [ebp + 0x78], eax
je 0x1000402b
push 0x101adb18
call fcn.10040879
push eax
push 0x1016f770
call fcn.10007842
add esp, 0xc
test eax, eax
je 0x1000402b
mov dword [ebp + 0x78], 2
xor eax, eax
cmp dword [0x101580c0], eax
je 0x1000403c
mov dword [ebp + 0x78], 6
mov ecx, dword [ebp + 0x68]
or dword [ecx], 0xffffffff
cmp dword [0x101580a8], eax
jne 0x10004051
mov ecx, dword [ebp + 0x70]
mov byte [ecx + 5], 1
mov dword [ebp + 0x7c], 0x40800
cmp dword [0x101adacc], eax
jne 0x10004075
push str.mail.
push 0x10151cd0
call fcn.10007842
pop ecx
pop ecx
test eax, eax
je 0x1000407c
mov dword [ebp + 0x7c], 0x40a00
mov eax, dword [0x10157ca4]
xor ecx, ecx
cmp eax, ecx
jne 0x1000408f
cmp dword [0x101580ac], ecx
je 0x10004096
or dword [ebp + 0x7c], 0x2000
mov edx, dword [0x102b5a34]
or dword [ebp + 0x7c], edx
cmp dword [0x101580a8], ecx
je 0x100041f0
test byte [0x10150600], 1
je 0x1000415b
xor edi, edi
lea esi, [ebp + edi*4 - 0x1c]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100044e0
imul eax, eax, 0x1210
lea ecx, [eax + 0x1018969c]
cmp byte [ecx], 0
je 0x100044e0
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x100040f2
cmp eax, 0x10
je 0x100040f2
cmp eax, 2
jne 0x10004105
push ecx
push dword [ebp + 0x78]
push str._NIE_g_sbIsOutLook_GetPackFileName_TC_SECURITY_FLT_FILE_SendInfoDisplayPack__0x_08x___s_
push 0
call fcn.100412e2
add esp, 0x10
mov eax, dword [esi]
imul eax, eax, 0x1210
add eax, 0x1018969c
push eax
call fcn.1002e0c5
pop ecx
test eax, eax
jne 0x1000414c
mov eax, dword [esi]
imul eax, eax, 0x1210
push 0
push dword [eax + 0x1018989c]
lea eax, [eax + 0x1018969c]
push eax
push dword [ebp + 0x78]
mov ecx, 0x101adac0
push dword [ebp + 0x7c]
call fcn.1003d6a9
test eax, eax
jne 0x100041e5
inc edi
cmp edi, 0x20
jl 0x100040ba
jmp 0x100044e0
cmp dword [ebp + 0x80], ecx
je 0x10004198
cmp dword [ebp + 0x80], 1
je 0x10004198
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x10004180
cmp eax, 0x10
je 0x10004180
cmp eax, 2
jne 0x10004198
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push str._NIE_g_sbIsOutLook_GetPackFileName_SendInfoDisplayPack__0x_08x___s_
push 0
call fcn.100412e2
add esp, 0x10
push dword [ebp + 0x80]
call fcn.1002e0c5
pop ecx
test eax, eax
jne 0x10003eb9
cmp dword [ebp + 0x80], eax
je 0x100044e0
mov eax, dword [ebp + 0x80]
cmp byte [eax], 0
je 0x100044e0
push 0
push dword [ebp + 0x6c]
mov ecx, 0x101adac0
push eax
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003d6a9
test eax, eax
je 0x100044e0
mov eax, dword [ebp + 0x68]
and dword [eax], 0
jmp 0x100044d6
cmp dword [0x101580c0], ecx
je 0x10004665
push ebx
lea eax, [ebp + 0x2b90]
push 0x100614c0
push eax
call fcn.10045378
push 0x2800
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.100417d5
add esp, 0x20
cmp dword [0x1015668c], 0
je 0x1000424a
lea eax, [ebp + 0x84]
push eax
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay__s_
push 0
call fcn.100412e2
add esp, 0xc
cmp byte [ebp + 0x84], 0
jne 0x1000428f
push ebx
lea eax, [ebp + 0x2b90]
push str._s_D
push eax
call fcn.10045378
push 0x2800
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.100417d5
add esp, 0x20
cmp byte [ebp + 0x84], 0
je 0x100044e0
push 0x10c
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.10045030
push 0x40
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp + 0x84]
push 0x7c
push eax
call fcn.100407f8
add esp, 0x1c
cmp dword [0x101580c0], 0x40
mov dword [ebp + 0x74], eax
ja 0x100044fc
push ebx
lea eax, [ebp + 0x2a8c]
push str._s_D
push eax
call fcn.10045378
push 0x208
lea eax, [ebp + 0x2884]
push eax
lea eax, [ebp + 0x2a8c]
push eax
push edi
push esi
call fcn.100417d5
push 0x84
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.10045030
push 0x200
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x2884]
push 0x10061474
push eax
call fcn.100407af
and dword [ebp + 0x80], 0
add esp, 0x3c
mov dword [ebp + 0x64], eax
test eax, eax
jle 0x1000444d
mov eax, dword [ebp + 0x80]
cmp eax, dword [ebp + 0x64]
jge 0x1000444d
mov esi, dword [ebp + eax*4 - 0xa0]
test esi, esi
je 0x1000444d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004360
sub eax, edx
cmp eax, 1
jbe 0x1000444d
cmp byte [esi], 0x22
jne 0x10004378
inc esi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000437d
sub eax, edx
cmp byte [eax + esi - 1], 0x20
jne 0x100043b4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004392
sub eax, edx
cmp byte [eax + esi - 2], 0x22
jne 0x100043b4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100043a7
sub eax, edx
mov byte [eax + esi - 2], cl
cmp dword [0x1015668c], 0x10
jne 0x100043cd
push esi
push str.get_g_ChromeFile__s_
push 0
call fcn.100412e2
add esp, 0xc
mov ebx, dword [ebp + 0x74]
add ebx, 0xfffffffe
js 0x100043f2
mov edi, dword [ebp + ebx*4 - 0x1ac]
test edi, edi
je 0x100043f2
push esi
push edi
call fcn.10007842
pop ecx
pop ecx
test eax, eax
jne 0x10004428
sub ebx, 2
jns 0x100043d5
and dword [ebp + 0x6c], 0
mov edi, esi
xor esi, esi
cmp edi, esi
je 0x1000441d
push esi
push esi
push esi
push dword [ebp + 0x6c]
mov ecx, 0x101adac0
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a717
test eax, eax
jne 0x100044d1
inc dword [ebp + 0x80]
jmp 0x1000433d
cmp dword [0x1015668c], 0x10
jne 0x10004441
push edi
push str.found_Send__s_
push 0
call fcn.100412e2
add esp, 0xc
push edi
call fcn.1000770a
pop ecx
mov dword [ebp + 0x6c], eax
jmp 0x100043f8
cmp byte [ebp + 0x2884], 0
je 0x10004482
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x1000446a
cmp eax, 0x10
je 0x1000446a
cmp eax, 2
jne 0x100044e0
lea eax, [ebp + 0x2884]
push eax
push str._NIE_GetPackFileName_exit_sTC_Chrome_D__s_
push 0
call fcn.100412e2
add esp, 0xc
jmp 0x100044e0
xor esi, esi
cmp dword [0x1015668c], esi
je 0x100044a1
lea eax, [ebp + 0x84]
push eax
push str._NIE_GetPackFileName_Not_Drag_xfer__s_
push esi
call fcn.100412e2
add esp, 0xc
cmp dword [ebp + 0x74], 1
jle 0x100044fe
push esi
push esi
push esi
push dword [ebp - 0x1a8]
call fcn.1004649a
pop ecx
push eax
push dword [ebp - 0x1ac]
mov ecx, 0x101adac0
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a717
test eax, eax
je 0x100044fe
mov eax, dword [ebp + 0x68]
mov dword [eax], esi
mov eax, dword [ebp + 0x70]
mov byte [eax + 0x1218], 1
mov al, 1
mov ecx, dword [ebp + 0x2c94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x2c98
leave
ret 0xc
xor esi, esi
cmp byte [0x102d3d93], 0
mov dword [ebp + 0x80], 0x7d0
je 0x1000451b
mov dword [ebp + 0x80], 0x2ee0
test byte [0x10150600], 0x10
jne 0x1000452e
add dword [ebp + 0x80], 0x36ee80
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x10004542
cmp eax, 0x10
je 0x10004542
cmp eax, 2
jne 0x10004553
push dword [ebp + 0x74]
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay_nCount__d_
push esi
call fcn.100412e2
add esp, 0xc
mov eax, dword [ebp + 0x74]
add eax, 0xfffffffe
cmp eax, esi
mov dword [ebp + 0x74], eax
jl 0x100044e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000456b
mov eax, dword [ebp + 0x74]
shl eax, 2
mov esi, dword [ebp + eax - 0x1ac]
test esi, esi
je 0x100044e0
push dword [ebp + eax - 0x1a8]
call fcn.1004649a
mov edi, eax
mov eax, dword [0x1015668c]
pop ecx
cmp eax, 3
je 0x100045a0
cmp eax, 0x10
je 0x100045a0
cmp eax, 2
jne 0x100045b1
push edi
push esi
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_member_chk_one__s_iOpenTime__d_
push 0
call fcn.100412e2
add esp, 0x10
sub dword [ebp + 0x74], 2
push esi
call fcn.1000770a
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x80]
pop ecx
add edi, eax
call ebx
cmp edi, eax
jb 0x10004624
push esi
call fcn.1002e0c5
pop ecx
test eax, eax
jne 0x10004624
xor edi, edi
cmp esi, edi
je 0x10004603
cmp esi, 1
je 0x10004603
cmp byte [esi], 0
je 0x10004603
push edi
push edi
push edi
push dword [ebp + 0x6c]
mov ecx, 0x101adac0
push esi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a717
test eax, eax
jne 0x1000465b
mov eax, dword [0x101580c0]
cmp eax, 0x40
jb 0x10004618
jbe 0x1000464c
cmp byte [0x102d3d93], 0
je 0x1000464c
add dword [ebp + 0x80], 0x1f4
jmp 0x1000464c
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x10004638
cmp eax, 0x10
je 0x10004638
cmp eax, 2
jne 0x1000464c
push esi
call ebx
push eax
push edi
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_continue_iOpenTime__mytime__d____GetTickCount__d___s_
push 0
call fcn.100412e2
add esp, 0x14
cmp dword [ebp + 0x74], 0
jge 0x10004568
jmp 0x100044e0
mov eax, dword [ebp + 0x68]
mov dword [eax], edi
jmp 0x100044d6
cmp eax, ecx
jne 0x10004803
cmp byte [0x100a2c18], 0
jne 0x10004803
test byte [0x10150600], 1
je 0x1000478c
cmp dword [0x101580b8], ecx
je 0x1000469b
cmp dword [0x101580bc], ecx
je 0x1000478c
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x100046af
cmp eax, 0x10
je 0x100046af
cmp eax, 2
jne 0x100046e3
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str._OpenedList__d:_d:_d:_d:_d:_d:_d:_d:_d:_d_
push 0
call fcn.100412e2
mov eax, dword [0x1015668c]
add esp, 0x30
xor ecx, ecx
xor edi, edi
jmp 0x100046ec
mov eax, dword [0x1015668c]
lea esi, [ebp + edi*4 - 0x1c]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x100044e0
mov edx, ecx
imul edx, edx, 0x1210
lea edx, [edx + 0x1018969c]
cmp byte [edx], 0
je 0x100044e0
cmp eax, 3
je 0x10004721
cmp eax, 0x10
je 0x10004721
cmp eax, 2
jne 0x10004736
push edx
push dword [ebp + 0x78]
push ecx
push edi
push str._NIE_GetPackFileName_TC_SECURITY_COMM_RAW_SendInfoDisplayPack__d___d__0x_08x___s_
push 0
call fcn.100412e2
add esp, 0x18
mov eax, dword [esi]
imul eax, eax, 0x1210
add eax, 0x1018969c
push eax
call fcn.1002e0c5
pop ecx
test eax, eax
jne 0x1000477d
mov eax, dword [esi]
imul eax, eax, 0x1210
push 0
push dword [eax + 0x1018989c]
lea eax, [eax + 0x1018969c]
push eax
push dword [ebp + 0x78]
mov ecx, 0x101adac0
push dword [ebp + 0x7c]
call fcn.1003d6a9
test eax, eax
jne 0x100041e5
inc edi
cmp edi, 0x20
jl 0x100046e7
jmp 0x100044e0
cmp dword [ebp + 0x80], ecx
je 0x100044e0
cmp dword [ebp + 0x80], 1
je 0x100044e0
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x100047b9
cmp eax, 0x10
je 0x100047b9
cmp eax, 2
jne 0x100047d1
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push str._NIE_GetPackFileName_SendInfoDisplay_else_0x_08x___s_
push 0
call fcn.100412e2
add esp, 0x10
mov eax, dword [ebp + 0x80]
cmp byte [eax], 0
je 0x100044e0
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x6c]
mov ecx, 0x101adac0
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a717
jmp 0x100041dd
mov eax, dword [0x1015668c]
cmp eax, 3
je 0x10004817
cmp eax, 0x10
je 0x10004817
cmp eax, 2
jne 0x1000482d
push 0x100a2c18
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay_g_sIE_Edit__s_
push 0
call fcn.100412e2
add esp, 0xc
xor ecx, ecx
xor eax, eax
mov cl, byte [eax + 0x100a2c18]
mov byte [ebp + eax + 0x2884], cl
inc eax
test cl, cl
jne 0x1000482f
push 0x84
xor esi, esi
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.10045030
push 0x200
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x2884]
push 0x10061474
push eax
call fcn.100407af
add esp, 0x1c
mov dword [ebp + 0x80], eax
xor eax, eax
mov cl, byte [eax + 0x101adb18]
mov byte [ebp + eax + 0x2a8c], cl
inc eax
test cl, cl
jne 0x1000487d
cmp dword [ebp + 0x80], esi
mov dword [ebp + 0x74], esi
jle 0x100044e0
mov eax, dword [ebp + 0x74]
cmp eax, dword [ebp + 0x80]
jge 0x100044e0
mov esi, dword [ebp + eax*4 - 0xa0]
test esi, esi
je 0x100044e0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100048c1
sub eax, edx
cmp eax, 1
jbe 0x100044e0
cmp byte [esi], 0x22
jne 0x100048d9
inc esi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100048de
sub eax, edx
cmp byte [eax + esi - 1], 0x20
jne 0x10004915
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100048f3
sub eax, edx
cmp byte [eax + esi - 2], 0x22
jne 0x10004915
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004908
sub eax, ecx
mov byte [eax + esi - 2], dl
cmp dword [0x1015668c], 0x10
jne 0x1000492e
push esi
push str.get_g_ChromeFile__s_
push 0
call fcn.100412e2
add esp, 0xc
mov ebx, dword [0x101ad89c]
jmp 0x10004950
cmp ebx, 0x20
jge 0x10004963
mov edi, eax
push esi
push edi
call fcn.10007842
pop ecx
pop ecx
test eax, eax
jne 0x1000499c
dec ebx
jns 0x10004950
push 0x1f
pop ebx
mov eax, ebx
imul eax, eax, 0x1210
lea eax, [eax + 0x1018969c]
cmp byte [eax], 0
jne 0x10004936
and dword [ebp + 0x6c], 0
mov edi, esi
xor esi, esi
cmp edi, esi
je 0x10004994
push esi
lea eax, [ebp + 0x2a8c]
push eax
push esi
push dword [ebp + 0x6c]
mov ecx, 0x101adac0
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a717
test eax, eax
jne 0x100044d1
inc dword [ebp + 0x74]
jmp 0x1000489e
cmp dword [0x1015668c], 0x10
jne 0x100049b5
push edi
push str.found_Send_IE__s_
push 0
call fcn.100412e2
add esp, 0xc
push edi
call fcn.1000770a
pop ecx
mov dword [ebp + 0x6c], eax
jmp 0x10004969