Function at 0x10029900
Capabilities:
Check for time delay via gettickcount
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10082d55
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.10021470
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x10029954
push 0x80004005
call fcn.10021340
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x68], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push dword [0x100b0f7c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x34]
push str.bInitialized_d__InitType_d
push eax
call fcn.1003a800
add esp, 0x10
mov byte [esp + 0x68], 1
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x68], 0
or edi, 0xffffffff
mov edx, dword [esp + 0x2c]
mov eax, edi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100299bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x20]
mov edx, 1
mov eax, dword [0x100b0f7c]
test ecx, ecx
cmove eax, edx
mov dword [0x100b0f7c], eax
xor eax, eax
mov dword [esp + 0x1c], eax
lea ebx, [ebx]
test ecx, ecx
je 0x100299f7
shl eax, 4
cmp dword [eax + 0x100af334], ecx
jne 0x1002a4c7
mov eax, dword [esp + 0x1c]
shl eax, 4
mov dword [esp + 0x2c], eax
cmp dword [eax + 0x100af334], 5
je 0x1002a4c7
mov edi, dword [eax + 0x100af33c]
lea eax, [eax + 0x100af33c]
mov ecx, edi
mov dword [esp + 0x14], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029a20
sub ecx, edx
mov dword [esp + 0x24], 0
sar ecx, 1
cmp ecx, 9
jbe 0x10029a8f
lea eax, [ecx - 9]
mov edx, str._UnWow64_
lea eax, [edi + eax*2]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x10029a6d
test cx, cx
je 0x10029a69
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x10029a6d
add eax, 4
add edx, 4
test cx, cx
jne 0x10029a47
xor eax, eax
jmp 0x10029a72
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10029a8f
call fcn.1003c5a0
mov edx, dword [esp + 0x24]
test eax, eax
mov ecx, 1
cmovne edx, ecx
mov dword [esp + 0x24], edx
jmp 0x10029a94
mov ecx, 1
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + 0x100af334]
inc eax
cmp eax, 5
ja case.0x10029aa8.0
jmp dword [eax*4 + 0x1002a5c0]
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push dword [edi + 0x100af338]
lea esi, [esp + 0x24]
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x7c], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.10022bb0
mov edx, esi
mov byte [esp + 0x7c], 0
mov ecx, SysReAllocStringLen
call fcn.1003b0d0
add esp, 0x14
test eax, eax
je 0x10029bd4
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
jle 0x10029b28
push 0x7e
push esi
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x10029b28
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x10029b28
lea ecx, [esp + 0x10]
call fcn.1003bd80
mov esi, dword [esp + 0x10]
push esi
call fcn.1006c1a9
mov edi, dword [esp + 0x18]
add esp, 4
mov dword [edi], eax
jmp 0x10029bdc
push 0
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push dword [edi + 0x100af338]
lea esi, [esp + 0x24]
call fcn.10022bb0
push ecx
mov byte [esp + 0x7c], 3
mov ecx, esp
mov dword [esp + 0x44], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
call fcn.10022bb0
push ecx
mov byte [esp + 0x80], 4
call fcn.1002b060
add esp, 4
mov byte [esp + 0x7c], 0
mov edx, esi
mov ecx, eax
call fcn.1003b0d0
add esp, 0x14
test eax, eax
je 0x10029bd4
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
jle 0x10029bc3
push 0x7e
push esi
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x10029bc3
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x10029bc3
lea ecx, [esp + 0x10]
call fcn.1003bd80
mov esi, dword [esp + 0x10]
push esi
call fcn.1006c1a9
mov edi, dword [esp + 0x18]
add esp, 4
mov dword [edi], eax
jmp 0x10029bdc
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x24], 0
je 0x1002a3f6
mov edi, dword [edi]
mov ecx, edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029bf0
sub ecx, edx
mov edx, str.__x86_
sar ecx, 1
lea eax, [ecx - 6]
lea eax, [edi + eax*2]
lea ebx, [ebx]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x1002a3d2
test cx, cx
je 0x10029c3a
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x1002a3d2
add eax, 4
add edx, 4
test cx, cx
jne 0x10029c10
xor eax, eax
jmp 0x1002a3d7
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x10029c62
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push dword [edi + 0x100af338]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ecx
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.100230b0
test edi, edi
je case.0x10029aa8.0
cmp dword [esi - 0xc], 0
jle 0x10029cb3
push 0x7e
push esi
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x10029cb3
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x10029cb3
lea ecx, [esp + 0x10]
call fcn.1003bd80
mov esi, dword [esp + 0x10]
push esi
call fcn.1006c1a9
mov edi, dword [esp + 0x18]
add esp, 4
mov dword [edi], eax
jmp 0x10029bdc
push str._MyExe_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x10029db3
mov ecx, dword [0x100b2cfc]
cmp dword [ecx - 0xc], eax
je 0x10029d0a
add ecx, 0xfffffff0
call fcn.100236e0
add eax, 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov byte [esp + 0x68], 5
or ebx, 1
jmp 0x10029d1e
lea ecx, [esp + 0x34]
call fcn.1003a230
mov dword [esp + 0x68], 6
or ebx, 2
mov edx, dword [eax]
lea edi, [esi - 0x10]
mov dword [esp + 0x18], ebx
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x10029d78
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x10029d67
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x10029d67
call fcn.100236e0
mov dword [esp + 0x30], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x10029d5e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x30]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
jmp 0x10029d78
push dword [edx - 0xc]
lea ecx, [esp + 0x14]
push edx
call fcn.10023530
mov esi, dword [esp + 0x10]
test bl, 2
je 0x10029d8d
and ebx, 0xfffffffd
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ebx
call fcn.10022680
mov dword [esp + 0x68], 0
test bl, 1
je 0x10029f23
and ebx, 0xfffffffe
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebx
call fcn.10022680
jmp 0x10029f23
push str._ExeDir_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x10029eb3
mov ecx, dword [0x100b2cfc]
cmp dword [ecx - 0xc], eax
je 0x10029e0d
push ecx
mov eax, 0x5c
add ecx, 0xfffffff0
movzx ebx, ax
mov edi, esp
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x40]
mov edx, ebx
mov dword [edi], eax
call fcn.1003a970
add esp, 4
mov byte [esp + 0x68], 7
mov ebx, dword [esp + 0x18]
or ebx, 4
jmp 0x10029e21
lea ecx, [esp + 0x38]
call fcn.1003a280
mov dword [esp + 0x68], 8
or ebx, 8
mov edx, dword [eax]
lea edi, [esi - 0x10]
mov dword [esp + 0x18], ebx
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x10029e7b
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x10029e6a
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x10029e6a
call fcn.100236e0
mov dword [esp + 0x30], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x10029e61
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x30]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
jmp 0x10029e7b
push dword [edx - 0xc]
lea ecx, [esp + 0x14]
push edx
call fcn.10023530
mov esi, dword [esp + 0x10]
test bl, 8
je 0x10029e90
and ebx, 0xfffffff7
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], ebx
call fcn.10022680
mov dword [esp + 0x68], 0
test bl, 4
je 0x10029f23
and ebx, 0xfffffffb
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ebx
call fcn.10022680
jmp 0x10029f23
push str._AppID_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x10029f23
mov edx, dword [0x100b2ce4]
lea edi, [esi - 0x10]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x10029f23
cmp dword [edi + 0xc], eax
lea esi, [edi + 0xc]
jl 0x10029f12
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x10029f12
call fcn.100236e0
mov dword [esp + 0x30], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x10029f09
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x30]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
jmp 0x10029f23
push dword [edx - 0xc]
lea ecx, [esp + 0x14]
push edx
call fcn.10023530
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
jle 0x10029f4e
push 0x7e
push esi
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x10029f4e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x10029f4e
lea ecx, [esp + 0x10]
call fcn.1003bd80
mov esi, dword [esp + 0x10]
push esi
call fcn.1006c1a9
mov edi, dword [esp + 0x18]
add esp, 4
mov dword [edi], eax
jmp 0x10029bdc
push str._Common_Profile_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a09f
push eax
push eax
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str.Common_Desktop
lea esi, [esp + 0x24]
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x7c], 9
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.10022bb0
mov edx, esi
mov byte [esp + 0x7c], 0
mov ecx, SysReAllocStringLen
call fcn.1003b0d0
mov esi, dword [esp + 0x24]
add esp, 0x10
mov eax, 0x5c
mov edi, esp
movzx ebx, ax
lea ecx, [esi - 0x10]
call fcn.100236e0
add eax, 0x10
lea ecx, [esp + 0x44]
mov edx, ebx
mov dword [edi], eax
call fcn.1003a970
add esp, 4
mov byte [esp + 0x68], 0xa
lea ebx, [esi - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x1002a039
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x1002a028
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1002a028
call fcn.100236e0
mov edi, eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x1002a01f
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [edi + 0x10]
mov dword [esp + 0x10], esi
jmp 0x1002a039
push dword [edx - 0xc]
lea ecx, [esp + 0x14]
push edx
call fcn.10023530
mov esi, dword [esp + 0x10]
mov byte [esp + 0x68], 0
or ecx, 0xffffffff
mov edx, dword [esp + 0x40]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a05c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
jle 0x1002a08f
push 0x7e
push esi
call fcn.1006ade1
add esp, 8
test eax, eax
je 0x1002a08f
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x1002a08f
lea ecx, [esp + 0x10]
call fcn.1003bd80
mov esi, dword [esp + 0x10]
push esi
call fcn.1006c1a9
add esp, 4
mov dword [edi], eax
jmp 0x10029bdc
push str._Program_Files__x86__
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a1b3
cmp dword [esp + 0x1c], eax
jne 0x1002a1b3
call fcn.1003c5a0
mov ecx, 1
sub ecx, dword [esi - 4]
test eax, eax
mov eax, dword [esi - 8]
je 0x1002a166
sub eax, 0x514
or eax, ecx
jge 0x1002a0f7
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push str.ProgramFiles_x86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x14]
call fcn.100230b0
cmp dword [esi - 0xc], 0
jne 0x1002a060
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str.ProgramFilesDir__x86_
lea esi, [esp + 0x24]
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x7c], 0xb
push str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.10022bb0
mov edx, esi
mov byte [esp + 0x7c], 0
mov ecx, SysReAllocStringLen
call fcn.1003b0d0
mov esi, dword [esp + 0x24]
add esp, 0x14
jmp 0x1002a060
sub eax, 0x514
or eax, ecx
jge 0x1002a181
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x14]
call fcn.100230b0
push str.__x86_
lea ecx, [esp + 0x14]
call fcn.10029340
mov esi, dword [esp + 0x10]
jmp 0x1002a060
push str._Program_Files_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a263
cmp dword [esp + 0x1c], 1
jne 0x1002a263
call fcn.1003c5a0
mov ecx, 1
sub ecx, dword [esi - 4]
test eax, eax
mov eax, dword [esi - 8]
je 0x1002a228
sub eax, 0x514
or eax, ecx
jge 0x1002a208
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push str.ProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x14]
call fcn.100230b0
jmp 0x1002a060
sub eax, 0x514
or eax, ecx
jge 0x1002a243
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x14]
call fcn.100230b0
jmp 0x1002a060
push str.AppDataXP
push dword [edi + 0x100af338]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a342
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x1008fa70
call fcn.10022bb0
push ecx
mov byte [esp + 0x70], 0xc
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Application_Data
call fcn.10022bb0
push ecx
mov ecx, esp
mov byte [esp + 0x74], 0xd
call fcn.1003da80
lea ecx, [esp + 0x50]
mov byte [esp + 0x74], 0
call fcn.1003a550
add esp, 0xc
mov byte [esp + 0x68], 0xe
lea edi, [esi - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x1002a32f
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x1002a31e
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1002a31e
call fcn.100236e0
mov dword [esp + 0x30], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x1002a304
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x30]
lea esi, [eax + 0x10]
mov byte [esp + 0x68], 0
lea ecx, [esp + 0x44]
mov dword [esp + 0x10], esi
call fcn.10022680
jmp 0x1002a060
push dword [edx - 0xc]
lea ecx, [esp + 0x14]
push edx
call fcn.10023530
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x44]
mov byte [esp + 0x68], 0
call fcn.10022680
jmp 0x1002a060
push str.ProfileRaw
push dword [edi + 0x100af338]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a39f
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x1002a37f
push 0x514
lea ecx, [esp + 0x14]
call fcn.10023670
mov esi, dword [esp + 0x10]
push 0x514
push esi
push str._USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ecx
lea ecx, [esp + 0x14]
call fcn.100230b0
jmp 0x1002a060
push str._Scripts_
push dword [edi + 0x100af330]
call fcn.1006af63
add esp, 8
test eax, eax
jne 0x1002a060
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push dword [edi]
call fcn.10022c70
mov esi, dword [esp + 0x10]
jmp 0x1002a064
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1002a3f6
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002a3e0
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [edi + ecx*2 - 0xc], ax
mov eax, dword [0x100b2d5c]
mov edi, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x1002a417
mov ecx, edi
call fcn.1002b130
mov eax, dword [0x100b2d5c]
cmp dword [eax - 0xc], 0
jne 0x1002a41e
mov eax, 0x1008fa88
jmp 0x1002a43f
push eax
lea eax, [esp + 0x50]
push str.__forced_UserProfile_s_
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x68], 0xf
or ebx, 0x10
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
push eax
push dword [edi]
mov eax, dword [esp + 0x34]
push dword [eax + 0x100af330]
lea eax, [esp + 0x54]
push str._s___s_s
push eax
call fcn.1003a800
add esp, 0x14
mov dword [esp + 0x68], 0x10
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x68], 0xf
or edi, 0xffffffff
mov edx, dword [esp + 0x48]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a492
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x68], 0
test bl, 0x10
je 0x1002a4c3
mov edx, dword [esp + 0x4c]
and ebx, 0xffffffef
add edx, 0xfffffff0
mov dword [esp + 0x18], ebx
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a4c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x26
jl 0x100299e0
mov eax, dword [0x100b2d58]
cmp dword [eax - 0xc], 0
jne 0x1002a4ef
lea ecx, [esp + 0x4c]
call fcn.1003b750
jmp 0x1002a502
push eax
lea eax, [esp + 0x50]
push str.RegistryUser_s
push eax
call fcn.1003a800
add esp, 0xc
push dword [eax]
call fcn.1006c1a9
mov edx, dword [esp + 0x50]
mov ecx, edi
add edx, 0xfffffff0
mov dword [0x100af31c], eax
add esp, 4
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a52e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100af31c]
add eax, 2
mov dword [0x100af32c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push str.Took__dms
push eax
call fcn.1003a800
add esp, 0xc
mov byte [esp + 0x68], 0x11
mov edx, dword [eax]
call fcn.100394f0
mov byte [esp + 0x68], 0
mov ecx, edi
mov edx, dword [esp + 0x4c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a586
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x68], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1002a5a5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret