Function at 0x1000cb50
Capabilities:
Check for time delay via gettickcount
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ac
mov eax, dword [0x10015018]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push esi
mov esi, dword [0x10019414]
push edi
cmp esi, dword [0x10019418]
je 0x1000ce84
mov ebx, dword [sym.imp.USER32.dll_FindWindowExA]
lea edi, [esi + 1]
jmp 0x1000cb90
movzx eax, byte [esi]
sub eax, 0
je 0x1000cc64
dec eax
jne 0x1000cc75
push eax
push edi
push eax
push eax
call ebx
test eax, eax
je 0x1000cc75
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x18]
inc esi
cmp dword [0x1001e9fc], 0
mov dword [esp + 0x1c], edx
jne 0x1000ce84
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.MSVCR100.dll_rand]
mov dword [0x1001e9fc], eax
mov word [esp + 0x10], 0x5c1
call edi
and eax, 0x800000ff
jns 0x1000cc03
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x10015284], 0xffffffff
mov byte [esp + 0x12], al
mov bl, 8
mov word [esp + 0x13], 0x8d2
je 0x1000cd96
cmp byte [0x100192b8], 0
je 0x1000cd96
mov word [esp + 0x20], 0x85c1
call edi
and eax, 0x800000ff
jns 0x1000cc41
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0xd2
mov byte [esp + 0x24], bl
test esi, esi
jne 0x1000cc9c
push 0x40
lea eax, [esp + 0x29]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x1000cca7
push edi
push 0
push 0
push 0
call ebx
test eax, eax
jne 0x1000cd25
add esi, 0x41
add edi, 0x41
cmp esi, dword [0x10019418]
jne 0x1000cb90
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.1000ce99
mov esp, ebp
pop ebp
ret
mov ecx, 0x10
lea edi, [esp + 0x25]
rep movsd dword es:[edi], dword [esi]
push 0x40
lea ecx, [esp + 0x69]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov esi, dword [esp + 0x28]
add esp, 0xc
test esi, esi
je 0x1000ce76
push 0x40
lea edx, [esp + 0x69]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000ce76
push 0x104
lea eax, [esp + 0xac]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000ce6f
lea esi, [esp + 0xa8]
call fcn.1000ba50
push eax
push 0x10012510
lea ecx, [esp + 0x6d]
push ecx
jmp 0x1000ce66
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
inc esi
cmp dword [0x1001e9fc], 0
mov dword [esp + 0x1c], eax
jne 0x1000ce84
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.MSVCR100.dll_rand]
mov dword [0x1001e9fc], eax
mov word [esp + 0x10], 0x5c1
call edi
and eax, 0x800000ff
jns 0x1000cd77
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x10015284], 0xffffffff
mov byte [esp + 0x12], al
mov bl, 8
mov word [esp + 0x13], 0x8d2
je 0x1000cd96
cmp byte [0x100192b8], 0
jne 0x1000cdb4
lea eax, [esp + 0x10]
call fcn.10002d40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.1000ce99
mov esp, ebp
pop ebp
ret
mov word [esp + 0x20], 0x85c1
call edi
and eax, 0x800000ff
jns 0x1000cdcb
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0xd2
mov byte [esp + 0x24], bl
test esi, esi
jne 0x1000cdee
push 0x40
lea ecx, [esp + 0x29]
push esi
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x1000cdf9
mov ecx, 0x10
lea edi, [esp + 0x25]
rep movsd dword es:[edi], dword [esi]
push 0x40
lea edx, [esp + 0x69]
push 0
push edx
call sub.MSVCR100.dll_memset
mov esi, dword [esp + 0x28]
add esp, 0xc
test esi, esi
je 0x1000ce76
push 0x40
lea eax, [esp + 0x69]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000ce76
push 0x104
lea ecx, [esp + 0xac]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000ce6f
lea esi, [esp + 0xa8]
call fcn.1000ba50
push eax
push 0x10012510
lea edx, [esp + 0x6d]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [esp + 0x21]
lea edx, [esp + 0x20]
call fcn.10001730
mov ecx, dword [esp + 0x2b4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000ce99
mov esp, ebp
pop ebp
ret