Function at 0x1000c979
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push 0x420
mov eax, 0x10018bc6
call fcn.1001851b
mov dword [ebp - 0x41c], edx
mov eax, ecx
mov dword [ebp - 0x400], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x408], ecx
test eax, eax
je 0x1000c9b9
mov edi, dword [0x1001bae4]
mov esi, 0x1001bae4
jmp 0x1000c9c4
mov edi, dword [0x1001b618]
mov esi, 0x1001b618
xor eax, eax
mov ebx, eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
jbe 0x1000c9e0
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [esi], eax
inc ebx
mov eax, dword [ebp - 0x41c]
xor ecx, ecx
test eax, eax
je 0x1000c9ee
mov dword [eax], ecx
mov eax, dword [ebp - 0x420]
mov esi, 0x104
push esi
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x220]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
xor eax, eax
push esi
push eax
lea eax, [ebp - 0x328]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp dword [ebp - 0x400], 0
je 0x1000ca3e
mov esi, 0x1001b8c0
mov dword [ebp - 0x404], 0x1001b608
mov edi, 0x1001b9d0
jmp 0x1000ca52
mov esi, 0x1001b630
mov dword [ebp - 0x404], 0x1001b568
mov edi, 0x1001b7a8
mov dword [ebp - 0x3f8], edi
mov dword [ebp - 0x3f4], esi
test ebx, ebx
je 0x1000cb54
lea eax, [ebp - 0x3ec]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10003b70
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000cade
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x3fc], 0x104
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000cad2
push esi
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpA]
test eax, eax
je 0x1000cad2
mov eax, dword [ebp - 0x404]
mov dword [eax], 1
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0x3ec]
push eax
push 0x20019
push ebx
push 0x10003b70
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000cb54
lea eax, [ebp - 0x3fc]
mov dword [ebp - 0x3fc], 0x104
push eax
lea eax, [ebp - 0x328]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1000cb48
push edi
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpA]
test eax, eax
je 0x1000cb48
mov eax, dword [ebp - 0x404]
mov dword [eax], 1
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x400], 0
mov ebx, dword [ebp - 0x3f4]
je 0x1000cb75
mov eax, dword [0x1001b610]
mov esi, 0x1001b610
mov ecx, dword [0x1001b544]
jmp 0x1000cb91
mov eax, dword [0x1001bad4]
mov esi, 0x1001bad4
mov ecx, dword [0x1001b540]
mov dword [ebp - 0x3f8], edi
mov dword [ebp - 0x3f4], ebx
mov edx, dword [ebp - 0x404]
cmp dword [edx], 0
je 0x1000cbae
test ecx, ecx
jne 0x1000cbae
test eax, eax
je 0x1000cbab
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
and dword [esi], 0
cmp dword [esi], 0
jne 0x1000d12f
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0xfffffffffffffffa
pop ecx
call fcn.10004f6a
or eax, sym.MAPI32.dll_Ordinal_9
jl 0x1000d129
cmp dword [ebp - 0x3fc], 0x220001
sete byte [ebp - 0x3ed]
xor eax, eax
mov dword [ebp - 0x3fc], eax
call fcn.1000a9b9
test eax, eax
je 0x1000cc49
push 0x10002138
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test eax, eax
je 0x1000cc17
push 0x10002138
jmp 0x1000cc41
push 0x10002144
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test eax, eax
je 0x1000cc2d
push 0x10002144
jmp 0x1000cc41
push 0x10002150
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
test eax, eax
je 0x1000cc49
push 0x10002150
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
mov dword [esi], eax
xor eax, eax
mov byte [ebp - 0x3ee], 1
cmp dword [esi], eax
jne 0x1000d0c9
call fcn.1000c4a9
test al, al
jne 0x1000cdf2
lea ecx, [ebp - 0x42c]
call fcn.1000be20
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x42c]
sub eax, ecx
cdq
mov dword [ebp - 0x40c], 0x18
idiv dword [ebp - 0x40c]
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x1000cd7d
cmp dword [ecx + 0x14], 8
jb 0x1000ccac
mov ecx, dword [ecx]
mov edx, ecx
lea ecx, [ebp - 0x360]
call fcn.1000c2f8
mov byte [ebp - 4], 1
cmp byte [ebp - 0x330], 0
je 0x1000cd04
cmp dword [ebp - 0x400], 0
je 0x1000cce6
cmp dword [ebp - 0x34c], 8
lea eax, [ebp - 0x360]
jb 0x1000ccfb
mov eax, dword [ebp - 0x360]
jmp 0x1000ccfb
cmp dword [ebp - 0x334], 8
lea eax, [ebp - 0x348]
jb 0x1000ccfb
mov eax, dword [ebp - 0x348]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
jmp 0x1000cd6e
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x40c]
call 0x10016411
lea ecx, [ebp - 0x3ec]
call fcn.1000bb3d
mov ax, word [ebp - 0x3ec]
xor ecx, ecx
test ah, ah
jne 0x1000cd46
mov dword [esi], ecx
cmp byte [ebp - 0x3ed], 0
je 0x1000cd63
test ah, ah
je 0x1000d147
test al, al
je 0x1000cd63
mov byte [ebp - 0x3ee], cl
jmp 0x1000cd70
push 0x10002160
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
mov dword [esi], eax
lea ecx, [ebp - 0x360]
call fcn.100149ff
jmp 0x1000cde7
cmp byte [ebp - 0x3ed], 0
je 0x1000cde7
mov ecx, 0x1001bb18
call fcn.100155b2
test al, al
je 0x1000cdd6
push 0x10002160
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
mov dword [esi], eax
test eax, eax
je 0x1000cddb
push 0x10002170
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000cdc1
mov ecx, edi
call dword [0x1001c2fc]
call edi
mov edx, dword [ebp - 0x400]
mov ecx, dword [esi]
call fcn.1000c518
mov edi, dword [ebp - 0x3f8]
jmp 0x1000cddb
call fcn.1000c6d2
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3f8], edi
lea ecx, [ebp - 0x42c]
call fcn.10015270
xor eax, eax
mov dword [ebp - 0x3ec], esi
mov edi, ebx
cmp dword [esi], eax
jne 0x1000d0c9
push 0x105
push eax
lea eax, [ebp - 0x118]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3fc]
lea ecx, [ebp - 0x118]
push eax
push dword [ebp - 0x400]
call fcn.1000b859
lea eax, [ebp - 0x118]
push 0x1000212c
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x1000d0a0
lea eax, [ebp - 0x118]
push 0x10001f88
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x1000d060
cmp byte [ebp - 0x3ee], 0
jne 0x1000ceb8
lea eax, [ebp - 0x118]
push 0x10002160
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1000ceb8
cmp dword [section..data], 5
jbe 0x1000d0a0
lea eax, [ebp - 0x350]
push eax
push 2
xor eax, eax
push eax
push eax
push 0x10004520
push section..data
call fcn.10004bd6
jmp 0x1000d0a0
lea ecx, [ebp - 0x118]
call fcn.100148c1
test eax, eax
je 0x1000ceed
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x1000ceed
mov ecx, 0x14c
mov word [eax], cx
xor eax, eax
push 0xc1
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0x1000d0a0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryA]
mov dword [esi], eax
test eax, eax
jne 0x1000d0a0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xc1
jne 0x1000d0a0
lea eax, [ebp - 0x40c]
xor ebx, ebx
push eax
mov dword [ebp - 0x40c], ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_wow64_l1_1_0.dll_IsWow64Process]
test eax, eax
je 0x1000cf3f
cmp dword [ebp - 0x40c], ebx
mov bh, 1
jne 0x1000cf41
mov bh, bl
mov edx, dword [ebp - 0x408]
lea ecx, [ebp - 0x118]
call fcn.1000aa7f
mov bl, al
test bh, bh
je 0x1000cf5c
test bl, bl
jne 0x1000cfc3
xor eax, eax
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_wow64_l1_1_0.dll_IsWow64Process]
test eax, eax
je 0x1000d04d
cmp dword [ebp - 0x408], 0
je 0x1000d04d
mov ecx, dword [ebp - 0x3ec]
mov esi, ecx
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], edi
test bh, bh
jne 0x1000d04d
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], edi
test bl, bl
jne 0x1000d04d
xor eax, eax
mov edi, 0x10002208
mov dword [ebp + 8], eax
test bl, bl
je 0x1000cfd6
mov edi, 0x10002258
xor ebx, ebx
lea ecx, [ebp - 0x3ec]
push ebx
mov dword [ebp - 0x3ec], ebx
call fcn.10014a4c
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x10002188
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000d039
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000d00d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0x100022a8
push ebx
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
cmp dword [ebp - 0x3ec], ebx
je 0x1000d04d
push dword [ebp - 0x3ec]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push 0xc1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, dword [ebp - 0x3f4]
jmp 0x1000d0a0
push 0x4000
lea eax, [ebp - 0x3e8]
push eax
push 0x10001cec
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x1000d089
xor edx, edx
xor ecx, ecx
call fcn.1000b0fd
test eax, eax
je 0x1000d0a0
push 0x800
xor eax, eax
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExA]
mov dword [esi], eax
xor eax, eax
cmp dword [esi], eax
jne 0x1000d0c9
mov edi, dword [ebp - 0x41c]
test edi, edi
je 0x1000d0ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [edi], eax
xor eax, eax
cmp dword [esi], eax
jne 0x1000d0c9
cmp dword [ebp + 8], 0
je 0x1000d0c9
call fcn.1000b9b1
cmp byte [ebp - 0x220], 0
je 0x1000d0e5
lea eax, [ebp - 0x220]
mov edx, 0x104
push eax
mov ecx, ebx
call fcn.10005061
cmp byte [ebp - 0x328], 0
je 0x1000d105
mov ecx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x328]
push eax
mov edx, 0x104
call fcn.10005061
cmp dword [ebp - 0x400], 0
je 0x1000d11f
xor eax, eax
cmp dword [esi], eax
je 0x1000d11f
mov eax, dword [ebp - 0x3fc]
mov dword [0x1001b79c], eax
mov eax, dword [ebp - 0x404]
xor ecx, ecx
mov dword [eax], ecx
xor eax, eax
cmp dword [esi], eax
je 0x1000d13d
mov eax, dword [ebp - 0x420]
mov ecx, dword [0x1001b79c]
mov dword [eax], ecx
mov eax, dword [esi]
call fcn.100184cd
ret 0xc
call fcn.1000765c
int3