Function at 0x5fee7fb6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2f4
mov eax, 0x5ff32112
call fcn.5ff1f8cb
mov dword [ebp - 0x1d8], ecx
mov al, byte [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov byte [ebp - 0x1d4], al
mov eax, dword [ebp + 0x1c]
xor esi, esi
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1dc], edi
mov dword [ebp - 0x1c8], eax
cmp ebx, esi
je 0x5fee8ae4
push ebx
call fcn.5ff1f982
pop ecx
test eax, eax
je 0x5fee8ae4
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x1cc], 2
call fcn.5feec33d
lea eax, [ebp - 0x1bc]
mov dword [ebp - 4], esi
push ebx
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c0], eax
call fcn.5fee91b5
push 0x30
lea eax, [ebp - 0x250]
push esi
push eax
mov byte [edi], 0
mov dword [ebp - 0x254], esi
call fcn.5ff1f9d0
mov dword [ebp - 0x210], esi
xor eax, eax
lea edi, [ebp - 0x20c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [ebp - 0x220]
stosd dword es:[edi], eax
call fcn.5fef9c03
push dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp - 0x20c], eax
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x210], 0x10
mov dword [ebp - 0x204], esi
call fcn.5fee7ea9
xor edi, edi
inc edi
mov dword [ebp - 0x1cc], eax
cmp eax, edi
je 0x5fee80fd
lea ecx, [ebp - 0x220]
call fcn.5fef9ffc
lea eax, [ebp - 0x1bc]
cmp dword [ebp - 0x1c0], eax
je 0x5fee80e5
push dword [ebp - 0x1c0]
call fcn.5ff1fcef
pop ecx
mov esi, dword [ebp - 0x1cc]
lea ecx, [ebp - 0x200]
call fcn.5feec2fb
mov eax, esi
jmp 0x5fee8b14
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x254], 0x34
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x248], 2
call fcn.5fee7e7f
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
call ebx
mov esi, eax
mov dword [ebp - 0x3a], 0xc24fc000
mov word [ebp - 0x36], 0xee95
cmp dword [ebp + 0x20], edi
jne 0x5fee8187
mov dword [ebp - 0x44], 0xf750e6c3
mov eax, 0x38ee
mov dword [ebp - 0x3e], 0xe58511d1
jmp 0x5fee819a
mov dword [ebp - 0x44], 0xaac56b
mov eax, 0xcd44
mov dword [ebp - 0x3e], 0xc28c11d0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 0x1c4], eax
call ebx
sub eax, esi
cmp eax, 0x1f4
jbe 0x5fee8247
mov ecx, dword [0x5ff4320c]
cmp ecx, 0x5ff4320c
je 0x5fee8240
test byte [ecx + 0x1c], 1
je 0x5fee8214
cmp byte [ecx + 0x19], 2
jb 0x5fee8214
mov edx, str.DRIVER_ACTION_VERIFY
cmp dword [ebp + 0x20], edi
je 0x5fee81ee
mov edx, str.WINTRUST_ACTION_GENERIC_VERIFY_V2
push eax
push dword [ebp - 0x1d0]
mov ebx, 0x5ff358c4
push edx
push ebx
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee7db6
mov ecx, dword [0x5ff4320c]
add esp, 0x1c
jmp 0x5fee8219
mov ebx, 0x5ff358c4
cmp ecx, 0x5ff4320c
je 0x5fee8252
test byte [ecx + 0x1c], 1
je 0x5fee8252
cmp byte [ecx + 0x19], 2
jb 0x5fee8252
push ebx
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee1540
add esp, 0x10
jmp 0x5fee824c
mov ebx, 0x5ff358c4
jmp 0x5fee8252
mov ebx, 0x5ff358c4
mov ecx, dword [0x5ff4320c]
cmp dword [ebp - 0x1c4], 0
je 0x5fee88c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5ff4320c]
mov edi, 0x5ff4320c
cmp ecx, edi
je 0x5fee82b5
test byte [ecx + 0x1c], 1
je 0x5fee82b5
cmp byte [ecx + 0x19], 4
jb 0x5fee82b5
cmp dword [ebp + 0x20], 1
mov edx, str.DRIVER_ACTION_VERIFY
je 0x5fee8290
mov edx, str.WINTRUST_ACTION_GENERIC_VERIFY_V2
push eax
push dword [ebp - 0x1c4]
push dword [ebp - 0x1d0]
push edx
push ebx
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee7cfe
mov ecx, dword [0x5ff4320c]
add esp, 0x20
cmp dword [ebp + 0xc], 3
jne 0x5fee82c5
cmp byte [ebp + 0x24], 1
jne 0x5fee8875
lea ecx, [ebp - 0x3c]
call fcn.5feeb082
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.5feeb07b
lea ecx, [ebp - 0x3c]
test eax, eax
jne 0x5fee8316
mov byte [ebp - 4], 3
call fcn.5feeb23b
lea ecx, [ebp - 0x220]
call fcn.5fef9ffc
lea eax, [ebp - 0x1bc]
cmp dword [ebp - 0x1c0], eax
je 0x5fee830e
push dword [ebp - 0x1c0]
call fcn.5ff1fcef
pop ecx
push 2
pop esi
jmp 0x5fee80eb
mov esi, dword [ebp - 0x1c0]
call fcn.5feeb07e
push eax
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0xbc]
push esi
call fcn.5feea8bd
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.5feea8ad
cmp eax, 1
jne 0x5fee8798
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.5feea2d9
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 6
call fcn.5feea163
mov al, byte [ebp - 0x2bc]
mov byte [ebp - 4], 7
cmp al, byte [ebp - 0x2e0]
je 0x5fee8749
mov eax, dword [ebp - 0x1dc]
mov esi, 0x5ff355d4
push esi
mov byte [eax], 1
call fcn.5ff1f982
pop ecx
mov ecx, dword [ebp - 0x1c8]
push eax
push esi
call fcn.5fee9519
mov al, byte [ebp - 0x2bc]
cmp al, byte [ebp - 0x2e0]
je 0x5fee8720
lea ecx, [ebp - 0x2dc]
call fcn.5fee916a
mov ecx, dword [ebp - 0x1c8]
push 0xffffffffffffffff
push 0
push eax
call fcn.5fee947e
xor esi, esi
push 0x30
lea eax, [ebp - 0x284]
push esi
push eax
mov dword [ebp - 0x288], esi
call fcn.5ff1f9d0
add esp, 0xc
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0x2b0], esi
lea edi, [ebp - 0x2ac]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x24]
call fcn.5fef9c03
mov eax, dword [ebp - 0x1c8]
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
mov dword [ebp - 0x2b0], 0x28
jb 0x5fee8427
mov eax, dword [eax]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x1c0]
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x2a0], eax
call fcn.5feea8b1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2a4], eax
call fcn.5feeb07e
push dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x1d8]
push dword [ebp - 0x1d0]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.5fee7ea9
mov dword [ebp - 0x1cc], eax
cmp eax, 1
je 0x5fee84cb
lea ecx, [ebp - 0x24]
call fcn.5fef9ffc
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 6
call fcn.5feea180
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.5feea180
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 4
call fcn.5feeadaa
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.5feeb23b
jmp 0x5fee80c0
mov ecx, dword [ebp - 0x1d8]
push 2
pop edx
push dword [ebp + 0x10]
lea eax, [ebp - 0x288]
xor esi, esi
push eax
mov dword [ebp - 0x288], 0x34
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], edx
call fcn.5fee7e7f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], esi
call edi
cmp dword [ebp + 0x20], 1
mov esi, eax
jne 0x5fee8565
mov eax, 0x38ee
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x288]
push eax
mov dword [ebp - 0x64], 0xf750e6c3
mov dword [ebp - 0x5e], 0xe58511d1
mov dword [ebp - 0x5a], 0xc24fc000
mov word [ebp - 0x56], 0xee95
lea eax, [ebp - 0x64]
jmp 0x5fee8593
mov eax, 0xcd44
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x288]
push eax
mov dword [ebp - 0x54], 0xaac56b
mov dword [ebp - 0x4e], 0xc28c11d0
mov dword [ebp - 0x4a], 0xc24fc000
mov word [ebp - 0x46], 0xee95
lea eax, [ebp - 0x54]
push eax
push 0xffffffffffffffff
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 0x1c4], eax
call edi
sub eax, esi
cmp eax, 0x1f4
jbe 0x5fee863f
mov ecx, dword [0x5ff4320c]
cmp ecx, 0x5ff4320c
je 0x5fee8645
test byte [ecx + 0x1c], 1
je 0x5fee860c
cmp byte [ecx + 0x19], 2
jb 0x5fee860c
cmp dword [ebp + 0x20], 1
mov esi, str.DRIVER_ACTION_VERIFY
je 0x5fee85de
mov esi, str.WINTRUST_ACTION_GENERIC_VERIFY_V2
mov edi, dword [ebp - 0x1c8]
cmp dword [edi + 0x14], 8
jb 0x5fee85ee
mov edx, dword [edi]
jmp 0x5fee85f0
mov edx, edi
push eax
push edx
push esi
push ebx
push 0x1a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee7db6
mov ecx, dword [0x5ff4320c]
add esp, 0x1c
jmp 0x5fee8612
mov edi, dword [ebp - 0x1c8]
cmp ecx, 0x5ff4320c
je 0x5fee864b
test byte [ecx + 0x1c], 1
je 0x5fee864b
cmp byte [ecx + 0x19], 2
jb 0x5fee864b
push ebx
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee1540
mov ecx, dword [0x5ff4320c]
add esp, 0x10
jmp 0x5fee864b
mov ecx, dword [0x5ff4320c]
mov edi, dword [ebp - 0x1c8]
cmp dword [ebp - 0x1c4], 0
jne 0x5fee86a9
cmp ecx, 0x5ff4320c
je 0x5fee8697
test byte [ecx + 0x1c], 1
je 0x5fee8697
cmp byte [ecx + 0x19], 4
jb 0x5fee8697
cmp dword [ebp + 0x20], 1
mov edx, str.DRIVER_ACTION_VERIFY
je 0x5fee8678
mov edx, str.WINTRUST_ACTION_GENERIC_VERIFY_V2
cmp dword [edi + 0x14], 8
jb 0x5fee8682
mov eax, dword [edi]
jmp 0x5fee8684
mov eax, edi
push eax
push edx
push ebx
push 0x1c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call section..text
add esp, 0x18
lea ecx, [ebp - 0x24]
call fcn.5fef9ffc
mov edi, 0x5ff4320c
jmp 0x5fee8775
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5ff4320c]
cmp ecx, 0x5ff4320c
je 0x5fee86ff
test byte [ecx + 0x1c], 1
je 0x5fee86ff
cmp byte [ecx + 0x19], 4
jb 0x5fee86ff
cmp dword [ebp + 0x20], 1
mov esi, str.DRIVER_ACTION_VERIFY
je 0x5fee86d9
mov esi, str.WINTRUST_ACTION_GENERIC_VERIFY_V2
cmp dword [edi + 0x14], 8
jb 0x5fee86e3
mov edx, dword [edi]
jmp 0x5fee86e5
mov edx, edi
push eax
push dword [ebp - 0x1c4]
push edx
push esi
push ebx
push 0x1d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee7cfe
add esp, 0x20
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.5fef9ffc
lea ecx, [ebp - 0x2dc]
call fcn.5fee9192
mov edi, 0x5ff4320c
jmp 0x5fee83a9
cmp dword [ebp - 0x1c4], 0
je 0x5fee8775
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee8775
test byte [eax + 0x1c], 1
je 0x5fee8775
cmp byte [eax + 0x19], 3
jb 0x5fee8775
push dword [ebp - 0x1d0]
push ebx
push 0x1e
jmp 0x5fee8767
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee8775
test byte [eax + 0x1c], 1
je 0x5fee8775
cmp byte [eax + 0x19], 4
jb 0x5fee8775
push dword [ebp - 0x1d0]
push ebx
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee15a0
add esp, 0x14
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 6
call fcn.5feea180
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.5feea180
jmp 0x5fee8854
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee87f0
test byte [eax + 0x1c], 1
je 0x5fee87c9
cmp byte [eax + 0x19], 4
jb 0x5fee87c9
push dword [ebp - 0x1d0]
push ebx
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee15a0
mov eax, dword [0x5ff4320c]
add esp, 0x14
cmp eax, edi
je 0x5fee87f0
test byte [eax + 0x1c], 1
je 0x5fee87f0
cmp byte [eax + 0x19], 4
jb 0x5fee87f0
push dword [ebp - 0x1c4]
push ebx
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1570
add esp, 0x14
lea ecx, [ebp - 0xbc]
call fcn.5feea8b9
cmp eax, 0x57
je 0x5fee8824
mov dword [ebp - 0x1c4], 0x800b0003
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee8854
test byte [eax + 0x1c], 1
je 0x5fee8854
cmp byte [eax + 0x19], 2
jb 0x5fee8854
push ebx
push 0x23
jmp 0x5fee8846
mov dword [ebp - 0x1c4], 0x800b0004
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee8854
test byte [eax + 0x1c], 1
je 0x5fee8854
cmp byte [eax + 0x19], 2
jb 0x5fee8854
push ebx
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 4
call fcn.5feeadaa
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.5feeb23b
mov ecx, dword [0x5ff4320c]
mov eax, dword [ebp - 0x1c4]
mov edx, 0x800b0004
cmp eax, edx
jg 0x5fee8953
je 0x5fee898f
cmp eax, 0x80092026
je 0x5fee88d2
cmp eax, 0x80096005
je 0x5fee88cb
cmp eax, 0x80096010
je 0x5fee898f
cmp eax, 0x800b0000
jle 0x5fee898f
cmp eax, 0x800b0003
jg 0x5fee898f
push 4
jmp 0x5fee8991
mov edi, 0x5ff4320c
jmp 0x5fee8875
push 0x14
jmp 0x5fee8991
mov eax, sub.WINTRUST.dll_WintrustGetRegPolicyFlags
test eax, eax
je 0x5fee898f
and dword [ebp - 0x1d4], 0
lea eax, [ebp - 0x1d4]
push eax
call sub.WINTRUST.dll_WintrustGetRegPolicyFlags
test dword [ebp - 0x1d4], 0x40000
je 0x5fee898f
mov eax, dword [0x5ff4320c]
cmp eax, edi
je 0x5fee88bd
test byte [eax + 0x1c], 1
je 0x5fee892d
cmp byte [eax + 0x19], 2
jb 0x5fee892d
push ebx
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
mov eax, dword [0x5ff4320c]
add esp, 0x10
cmp eax, edi
je 0x5fee88bd
test byte [eax + 0x1c], 1
je 0x5fee88bd
cmp byte [eax + 0x19], 2
jb 0x5fee88bd
push ebx
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
jmp 0x5fee88bd
cmp eax, 0x800b0100
je 0x5fee898f
cmp eax, 0x800b010e
je 0x5fee896a
test eax, eax
jne 0x5fee898f
xor esi, esi
inc esi
jmp 0x5fee8992
cmp ecx, edi
je 0x5fee898b
test byte [ecx + 0x1c], 1
je 0x5fee898b
cmp byte [ecx + 0x19], 2
jb 0x5fee898b
push ebx
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.5fee1540
add esp, 0x10
push 0xf
jmp 0x5fee8991
push 3
pop esi
lea ecx, [ebp - 0x220]
call fcn.5fef9ffc
lea eax, [ebp - 0x1bc]
cmp dword [ebp - 0x1c0], eax
je 0x5fee8a3c
push dword [ebp - 0x1c0]
call fcn.5ff1fcef
pop ecx
jmp 0x5fee8a3c
lea ecx, [ebp - 0x200]
call fcn.5feec2e5
test al, al
je 0x5fee80eb
push 6
jmp 0x5fee8310
mov eax, dword [0x5ff4320c]
cmp eax, 0x5ff4320c
je 0x5fee8b11
test byte [eax + 0x1c], 1
je 0x5fee8b11
cmp byte [eax + 0x19], 2
jb 0x5fee8b11
push 0x5ff358c4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.5fee1540
add esp, 0x10
push 5
pop eax
call fcn.5ff1f927
ret 0x20