Function at 0x11dda110
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb626d
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
sub esp, 0x130
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x11dda160
mov ebp, dword [esp + 0x154]
push ebx
push ebp
push str.SetTP3_1_1_dwPPId__lu__dwProcessId__lu__r_n
push 0x120abd4c
push 1
call fcn.11ca5810
add esp, 0x14
jmp 0x11dda167
mov ebp, dword [esp + 0x154]
mov edi, dword [esp + 0x160]
push esi
push ebp
push edi
push ebx
mov ecx, 0x12118ec8
call fcn.11c92fb0
test eax, eax
je 0x11dda3fd
lea ecx, [esp + 0x10]
call fcn.11e26080
lea ecx, [esp + 0xb8]
mov dword [esp + 0x148], esi
call fcn.11e84ba0
lea ecx, [esp + 0x98]
mov byte [esp + 0x148], 1
call fcn.11e84ba0
lea ecx, [esp + 0x78]
mov byte [esp + 0x148], 2
call fcn.11e84ba0
lea ecx, [esp + 0x58]
mov byte [esp + 0x148], 3
call fcn.11e84ba0
lea ecx, [esp + 0xa8]
mov byte [esp + 0x148], 4
call fcn.11e84ba0
lea ecx, [esp + 0xc8]
mov byte [esp + 0x148], 5
call fcn.11e84ba0
lea ecx, [esp + 0x88]
mov byte [esp + 0x148], 6
call fcn.11e84ba0
lea ecx, [esp + 0xd8]
mov byte [esp + 0x148], 7
call fcn.11e84ba0
lea ecx, [esp + 0x48]
mov byte [esp + 0x148], 8
call fcn.11e84ba0
lea ecx, [esp + 0x68]
mov byte [esp + 0x148], 9
call fcn.11e84ba0
lea ecx, [esp + 0x38]
mov byte [esp + 0x148], 0xa
call fcn.11e84ba0
lea ecx, [esp + 0x28]
mov byte [esp + 0x148], 0xb
call fcn.11e84ba0
push esi
lea eax, [esp + 0x5c]
push esi
lea ecx, [esp + 0x80]
push eax
lea edx, [esp + 0x74]
push ecx
lea eax, [esp + 0x58]
push edx
lea ecx, [esp + 0xec]
push eax
lea edx, [esp + 0xa0]
push ecx
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0xec]
push ecx
lea eax, [esp + 0xd0]
push edx
lea ecx, [esp + 0xc4]
push eax
lea edx, [esp + 0xe8]
push ecx
push edx
push esi
push esi
mov byte [esp + 0x188], 0xc
push esi
mov eax, dword [esp + 0x1a0]
mov ecx, dword [esp + 0x194]
push esi
push eax
push edi
push ebx
push ecx
lea ecx, [esp + 0x68]
call fcn.11e27450
cmp dword [0x12133f80], esi
je 0x11dda301
push ebx
push str.SetTP3_Process_PID_lu__is_in_SecuDesktop__r_n
push 0x120abd4c
push 1
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x28]
mov byte [esp + 0x148], 0xb
call fcn.11e84bb0
lea ecx, [esp + 0x38]
mov byte [esp + 0x148], 0xa
call fcn.11e84bb0
lea ecx, [esp + 0x68]
mov byte [esp + 0x148], 9
call fcn.11e84bb0
lea ecx, [esp + 0x48]
mov byte [esp + 0x148], 8
call fcn.11e84bb0
lea ecx, [esp + 0xd8]
mov byte [esp + 0x148], 7
call fcn.11e84bb0
lea ecx, [esp + 0x88]
mov byte [esp + 0x148], 6
call fcn.11e84bb0
lea ecx, [esp + 0xc8]
mov byte [esp + 0x148], 5
call fcn.11e84bb0
lea ecx, [esp + 0xa8]
mov byte [esp + 0x148], 4
call fcn.11e84bb0
lea ecx, [esp + 0x58]
mov byte [esp + 0x148], 3
call fcn.11e84bb0
lea ecx, [esp + 0x78]
mov byte [esp + 0x148], 2
call fcn.11e84bb0
lea ecx, [esp + 0x98]
mov byte [esp + 0x148], 1
call fcn.11e84bb0
lea ecx, [esp + 0xb8]
mov byte [esp + 0x148], 0
call fcn.11e84bb0
lea ecx, [esp + 0x10]
mov dword [esp + 0x148], 0xffffffff
call fcn.11e260b0
mov eax, 1
jmp 0x11ddab37
mov ecx, 0x1212b318
call fcn.11debe00
test eax, eax
jne 0x11dda431
mov ecx, 0x1212b318
call fcn.11de9e20
cmp dword [0x12133f80], esi
je 0x11dda431
push str.SetTP3_UpdateSafeSoftLib_r_n
push str.TSDEncryptDrv
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
cmp dword [esp + 0x15c], esi
je 0x11dda46c
push ebx
mov ecx, 0x1212de08
call fcn.11df2ec0
push ebx
call fcn.11e0bfc0
mov eax, dword [0x12133f80]
add esp, 4
cmp eax, esi
je 0x11dda48a
push ebx
push str.Del_Process_pid__lu__at_boot
push str.SetTP12
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x10
cmp dword [0x12133f80], esi
je 0x11dda48a
push ebx
push ebp
push str.SetTP3_1_1_dwPPId__lu__dwProcessId__lu__r_n
push str.IPG7867
push 1
call fcn.11ca5810
add esp, 0x14
mov ecx, 0x12124630
call fcn.11cbfee0
mov ecx, 0x1212b5c0
call fcn.11d96bd0
mov dword [esp + 0x10], eax
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], esi
push ebp
rep stosd dword es:[edi], eax
mov ecx, 0x1212de08
call fcn.11df2fb0
mov ebp, eax
cmp ebp, esi
je 0x11dda709
cmp dword [0x12133f80], esi
je 0x11dda4ea
push str.SetTP3_1_2__r_n
push 0x120abd4c
push 1
call fcn.11ca5810
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
add edx, eax
lea ecx, [ebp + edx*2 + 0xd8]
lea edx, [ebp + eax*2 + 0xd6]
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xd4]
push edx
mov edx, dword [ebp + 4]
push eax
mov eax, dword [ebp]
push ecx
push edx
push eax
mov ecx, 0x12126430
call fcn.11db98d0
mov eax, dword [ebp + 0x5c]
lea esi, [ebp + 0x68]
mov ecx, 0xb
lea edi, [esp + 0xe8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xe8]
push ecx
push eax
mov ecx, 0x12124630
call fcn.11cc0820
mov ecx, 0x1212b5c0
call fcn.11d5f990
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [0x1212480c], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x11dda665
mov eax, dword [esp + 0x10]
test eax, eax
je 0x11dda5c1
lea edx, [ebp + 0xbc]
mov eax, dword [ebp + 0xbc]
mov dword [esp + 0x28], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x2c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xcc]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp + 0xd0]
mov dword [esp + 0x34], ecx
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, 0x12124630
call fcn.11cc0870
mov edx, dword [ebp + 0xb8]
mov ecx, 0x12124630
push edx
call fcn.11cc0670
mov eax, dword [ebp + 0xc]
mov ecx, 0x121247e8
push eax
call fcn.11cc4ce0
test eax, eax
je 0x11dda665
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x121247ec]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [eax + eax*2]
shl ecx, 4
lea esi, [ecx + edx + 8]
lea ecx, [esp + 0x38]
call fcn.11e18920
push 1
lea edx, [esp + 0x18]
push 1
lea eax, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x158], 0xd
push esi
mov ecx, 0x121247e8
mov dword [esp + 0x28], 0
call fcn.11cc4de0
test eax, eax
je 0x11dda63f
push 1
push eax
push esi
mov ecx, 0x1212b458
call fcn.11df33e0
mov edi, 1
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, 0x121247e8
call fcn.11cc4da0
lea ecx, [esp + 0x38]
mov dword [esp + 0x148], 0xffffffff
call fcn.11e18940
test edi, edi
jne 0x11dda66f
mov ecx, 0x1212b458
call fcn.11df33a0
mov esi, 1
push ebp
mov ecx, 0x1212b5c0
mov dword [0x1212c7f8], esi
mov dword [0x1212c128], esi
call fcn.11d8db40
mov eax, dword [0x12133f80]
test eax, eax
je 0x11dda6cb
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x154]
mov ebp, dword [esp + 0x160]
mov ecx, dword [esp + 0x164]
push edx
push ebx
push eax
push ebp
push ecx
push str.Sim_Parent_Process_cmd__s__path__s__ppid__lu__pid__lu__ctxid_0x_lx_
push 0x120abd4c
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x20
jmp 0x11dda6d2
mov ebp, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
mov ecx, 0x1212ae98
push edx
push ebp
call fcn.11d372b0
cmp eax, esi
je 0x11dda6f0
cmp eax, 2
je 0x11dda6f0
xor esi, esi
push 0
push ebp
push eax
push ebx
mov ecx, 0x1212ae98
call fcn.11d377a0
push ebx
push ebp
call fcn.11d46300
add esp, 8
mov ecx, 0x1212b5c0
call fcn.11d9fc90
push esi
mov esi, dword [esp + 0x170]
push esi
mov ecx, 0x12124630
call fcn.11cc2060
mov ecx, 0x12124630
call fcn.11cc0690
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
mov ebp, dword [esp + 0x160]
mov edx, dword [esp + 0x154]
push eax
mov eax, dword [esp + 0x160]
push ecx
push ebp
push edx
push eax
push ebx
mov ecx, 0x12126430
call fcn.11db98d0
mov ecx, 0x1212b5c0
call fcn.11d5f990
xor edi, edi
cmp esi, 0xffffffff
mov dword [0x1212480c], esi
mov dword [esp + 0x18], edi
je 0x11dda823
push esi
mov ecx, 0x121247e8
call fcn.11cc4ce0
test eax, eax
je 0x11dda823
mov ecx, dword [0x121247ec]
lea eax, [esi*8]
sub eax, esi
lea edx, [eax + eax*2]
shl edx, 4
lea edi, [edx + ecx + 8]
lea ecx, [esp + 0x38]
call fcn.11e18920
push 1
lea eax, [esp + 0x18]
push 1
lea ecx, [esp + 0x40]
push eax
push ecx
mov dword [esp + 0x158], 0xe
push edi
mov ecx, 0x121247e8
mov dword [esp + 0x28], 0
call fcn.11cc4de0
test eax, eax
je 0x11dda7fc
push 1
push eax
push edi
mov ecx, 0x1212b458
call fcn.11df33e0
mov edi, 1
jmp 0x11dda800
mov edi, dword [esp + 0x18]
push esi
mov ecx, 0x121247e8
call fcn.11cc4da0
lea ecx, [esp + 0x38]
mov dword [esp + 0x148], 0xffffffff
call fcn.11e18940
test edi, edi
jne 0x11dda82f
mov ecx, 0x1212b458
call fcn.11df33a0
jmp 0x11dda831
xor edi, edi
mov eax, 1
push edi
push eax
push eax
mov ecx, 0x1212b5c0
mov dword [0x1212c7f8], eax
mov dword [0x1212c128], eax
call fcn.11d60760
lea ecx, [esp + 0x1c]
call fcn.11e923e0
mov eax, dword [esp + 0x150]
lea edx, [esp + 0x1c]
push edx
push edi
push eax
push 1
mov dword [esp + 0x158], 0xf
call fcn.11dde3e0
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebp
call fcn.11ddef50
add esp, 0x1c
mov ecx, 0x1212b5c0
call fcn.11d98670
test eax, eax
je 0x11dda89e
push ebx
mov ecx, 0x1212aef8
call fcn.11d57cd0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x38], eax
mov eax, dword [0x12133f80]
cmp eax, edi
je 0x11dda8df
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x164]
push edx
push ebx
push eax
push ebp
push ecx
push str.SetTP_cmd__s__path__s__ppid__lu__pid__lu__ctxid_0x_lx_
push 0x120abd4c
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x20
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x164]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x160]
push eax
mov eax, dword [esp + 0x15c]
push ecx
push ebp
push edx
push ebx
push eax
push esi
mov ecx, 0x12124630
call fcn.11cc3460
push edi
push edi
push edi
mov ecx, 0x1212b5c0
call fcn.11d60760
test eax, eax
jne 0x11dda954
mov eax, dword [0x121246cc]
push eax
call fcn.11cc0610
add esp, 4
test eax, eax
jne 0x11dda954
mov ecx, 0x1212b5c0
call fcn.11d71450
test eax, eax
jne 0x11dda954
mov ecx, 0x1212b5c0
call fcn.11d71460
test eax, eax
je 0x11ddaaf9
cmp esi, 0xffffffff
je 0x11ddaaf9
push edi
mov ecx, 0x1212b5c0
call fcn.11d88cd0
test eax, eax
je 0x11ddaaf9
xor ecx, ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x114], edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x118]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x124]
push eax
push ecx
mov ecx, 0x12124630
call fcn.11cc2aa0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x11ddaa79
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x11ddaa32
mov edx, dword [esp + 0x14]
test edx, edx
jbe 0x11ddaa32
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push edx
lea edx, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x170]
push edx
mov edx, dword [esp + 0x168]
push ecx
mov ecx, dword [esp + 0x174]
push esi
push eax
mov eax, dword [esp + 0x16c]
push ecx
push ebp
push edx
push ebx
push eax
mov ecx, 0x1212de08
call fcn.11df20a0
jmp 0x11ddaab5
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x114]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x174]
push ecx
mov ecx, dword [esp + 0x170]
push esi
push edx
mov edx, dword [esp + 0x170]
push eax
push ebp
push ecx
push ebx
push edx
mov ecx, 0x1212de08
call fcn.11df26e0
jmp 0x11ddaab5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x16c]
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x16c]
push edx
mov edx, dword [esp + 0x168]
push esi
push eax
mov eax, dword [esp + 0x168]
push ecx
push ebp
push edx
push ebx
push eax
mov ecx, 0x1212de08
call fcn.11df18b0
mov eax, dword [0x12133f80]
test eax, eax
je 0x11ddaaf7
mov ecx, 0x1212de08
call fcn.11df3000
mov ecx, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
push eax
mov eax, dword [esp + 0x168]
push ecx
push ebx
push edx
push ebp
push eax
push str.Add_Process_cmd__s__path__s__ppid__lu__pid__lu__ctxid_0x_lx__count__d_
push 0x120abd4c
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x24
xor edi, edi
cmp dword [esp + 0x10], edi
je 0x11ddab13
mov ecx, 0x12124630
call fcn.11cc0420
mov ecx, 0x12124630
call fcn.11cc0480
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x148], 0xffffffff
sub eax, ecx
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.11e92540
mov eax, esi
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x13c
ret 0x20