Function at 0x10003dd6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x2c98]
mov eax, 0x2e44
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x2c94], eax
cmp byte [ecx + 0x1219], 0
mov eax, dword [ebp + 0x2ca4]
push ebx
push esi
push edi
mov dword [ebp + 0x74], ecx
mov dword [ebp + 0x68], eax
je 0x100048cc
cmp dword [0x101434ac], 2
jne 0x10003e28
push str.GetPackFileName_start
push 0
call fcn.1003dfed
pop ecx
pop ecx
test dword [0x1014469c], 0x200
mov esi, dword [0x10144ec8]
je 0x10003e4f
test esi, esi
je 0x10003e4f
mov eax, dword [ebp + 0x74]
mov byte [eax + 0x1218], 1
xor al, al
jmp 0x100048ce
push 0x80
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.10040850
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
je 0x10003e70
mov al, byte [ebp + 0x2ca8]
jmp 0x10003e7a
mov eax, dword [ebp + 0x74]
movzx eax, byte [eax + 0x121b]
push eax
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x10171a78
call fcn.100288fe
mov edi, eax
mov dword [ebp + 0x80], edi
cmp edi, ebx
je 0x10003e48
cmp dword [0x101434ac], ebx
je 0x10003efa
test byte [0x1013dc2c], 1
je 0x10003ee3
xor esi, esi
mov ecx, dword [ebp + esi*4 - 0x1c]
cmp ecx, 0xffffffff
je 0x10003efa
mov eax, ecx
imul eax, eax, 0x1210
push dword [eax + 0x1017227c]
lea eax, [eax + 0x1017207c]
push eax
push ecx
push esi
push edi
push str.GetPackFileName_List:count__d_ii__d_List__d___s___d_
push ebx
call fcn.1003dfed
add esp, 0x1c
inc esi
cmp esi, 0x20
jl 0x10003eac
jmp 0x10003efa
cmp edi, 1
je 0x10003efa
push dword [ebp + 0x70]
push edi
push str.GetPackFileName_:_s___d
push ebx
call fcn.1003dfed
add esp, 0x10
mov esi, str.test
lea edi, [ebp + 0x84]
movsd dword es:[edi], dword [esi]
push 0x27fb
lea eax, [ebp + 0x89]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.10040850
add esp, 0xc
cmp dword [0x10144edc], 0
mov ebx, 0x10142a48
mov edi, str.SoftWareTrojanCut_tc_MultiX
mov esi, reloc.WS2_32.dll_bind
je 0x10003f6e
push ebx
lea eax, [ebp + 0x2b90]
push 0x1005d504
push eax
call fcn.10040b98
push 0x5b6a7988
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.1003d897
mov dword [0x100724a8], eax
lea eax, [ebp + 0x84]
add esp, 0x1c
mov dword [ebp + 0x80], eax
mov eax, dword [ebp + 0x74]
cmp byte [eax + 5], 0
mov byte [eax + 4], 1
jne 0x100048cc
xor eax, eax
cmp byte [ebp + 0x2ca0], al
sete al
add eax, 5
cmp byte [0x101964f0], 0
mov dword [ebp + 0x78], eax
je 0x10003fbc
push 0x101964f0
call fcn.1003d4b1
push eax
push 0x1015c588
call fcn.10007480
add esp, 0xc
test eax, eax
je 0x10003fbc
mov dword [ebp + 0x78], 2
xor eax, eax
cmp dword [0x10144edc], eax
je 0x10003fcd
mov dword [ebp + 0x78], 6
mov ecx, dword [ebp + 0x68]
or dword [ecx], 0xffffffff
cmp dword [0x10144ec8], eax
jne 0x10003fe2
mov ecx, dword [ebp + 0x74]
mov byte [ecx + 5], 1
mov dword [ebp + 0x7c], 0x40800
cmp dword [0x101964a4], eax
jne 0x10004005
push str.mail.
push 0x1013f2f0
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1000400c
mov dword [ebp + 0x7c], 0x40a00
mov eax, dword [0x10144ec4]
xor ecx, ecx
cmp eax, ecx
jne 0x1000401f
cmp dword [0x10144ecc], ecx
je 0x10004026
or dword [ebp + 0x7c], 0x2000
mov edx, dword [0x1029e3f4]
or dword [ebp + 0x7c], edx
cmp dword [0x10144ec8], ecx
je 0x10004180
test byte [0x1013dc2c], 1
je 0x100040eb
xor edi, edi
lea esi, [ebp + edi*4 - 0x1c]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100048cc
imul eax, eax, 0x1210
lea ecx, [eax + 0x1017207c]
cmp byte [ecx], 0
je 0x100048cc
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x10004082
cmp eax, 0x10
je 0x10004082
cmp eax, 2
jne 0x10004095
push ecx
push dword [ebp + 0x78]
push str._NIE_g_sbIsOutLook_GetPackFileName_TC_SECURITY_FLT_FILE_SendInfoDisplayPack__0x_08x___s_
push 0
call fcn.1003dfed
add esp, 0x10
mov eax, dword [esi]
imul eax, eax, 0x1210
add eax, 0x1017207c
push eax
call fcn.1002abf8
pop ecx
test eax, eax
jne 0x100040dc
mov eax, dword [esi]
imul eax, eax, 0x1210
push 0
push dword [eax + 0x1017227c]
lea eax, [eax + 0x1017207c]
push eax
push dword [ebp + 0x78]
mov ecx, 0x10196498
push dword [ebp + 0x7c]
call fcn.1003a51d
test eax, eax
jne 0x10004175
inc edi
cmp edi, 0x20
jl 0x1000404a
jmp 0x100048cc
cmp dword [ebp + 0x80], ecx
je 0x10004128
cmp dword [ebp + 0x80], 1
je 0x10004128
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x10004110
cmp eax, 0x10
je 0x10004110
cmp eax, 2
jne 0x10004128
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push str._NIE_g_sbIsOutLook_GetPackFileName_SendInfoDisplayPack__0x_08x___s_
push 0
call fcn.1003dfed
add esp, 0x10
push dword [ebp + 0x80]
call fcn.1002abf8
pop ecx
test eax, eax
jne 0x10003e48
cmp dword [ebp + 0x80], eax
je 0x100048cc
mov eax, dword [ebp + 0x80]
cmp byte [eax], 0
je 0x100048cc
push 0
push dword [ebp + 0x70]
mov ecx, 0x10196498
push eax
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.1003a51d
test eax, eax
je 0x100048cc
mov eax, dword [ebp + 0x68]
and dword [eax], 0
jmp 0x100048c2
cmp dword [0x10144edc], ecx
je 0x1000458a
push ebx
lea eax, [ebp + 0x2b90]
push 0x1005d458
push eax
call fcn.10040b98
push 0x2800
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.1003e4ea
mov eax, dword [0x101434ac]
add esp, 0x20
cmp eax, 3
je 0x100041cf
cmp eax, 0x10
je 0x100041cf
cmp eax, 2
jne 0x100041e5
lea eax, [ebp + 0x84]
push eax
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay__s_
push 0
call fcn.1003dfed
add esp, 0xc
cmp byte [ebp + 0x84], 0
jne 0x1000422a
push ebx
lea eax, [ebp + 0x2b90]
push str._s_D
push eax
call fcn.10040b98
push 0x2800
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp + 0x2b90]
push eax
push edi
push esi
call fcn.1003e4ea
add esp, 0x20
cmp byte [ebp + 0x84], 0
je 0x100048cc
push 0x10c
lea eax, [ebp - 0x1ac]
push 0
push eax
call fcn.10040850
push 0x40
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp + 0x84]
push 0x7c
push eax
call fcn.1003d430
add esp, 0x1c
cmp dword [0x10144edc], 0x40
mov dword [ebp + 0x64], eax
ja 0x10004420
push ebx
lea eax, [ebp + 0x2884]
push str._s_D
push eax
call fcn.10040b98
push 0x208
lea eax, [ebp + 0x2988]
push eax
lea eax, [ebp + 0x2884]
push eax
push edi
push esi
call fcn.1003e4ea
push 0x84
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.10040850
push 0x200
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x2988]
push 0x1005d40c
push eax
call fcn.1003d3e7
and dword [ebp + 0x6c], 0
add esp, 0x3c
mov dword [ebp + 0x80], eax
test eax, eax
jle 0x100043e4
mov eax, dword [ebp + 0x6c]
cmp eax, dword [ebp + 0x80]
jge 0x100043e4
mov esi, dword [ebp + eax*4 - 0xa0]
test esi, esi
je 0x100043e4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100042fb
sub eax, edx
cmp eax, 1
jbe 0x100043e4
cmp byte [esi], 0x22
jne 0x10004313
inc esi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004318
sub eax, edx
cmp byte [eax + esi - 1], 0x20
jne 0x1000434f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000432d
sub eax, edx
cmp byte [eax + esi - 2], 0x22
jne 0x1000434f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004342
sub eax, edx
mov byte [eax + esi - 2], cl
cmp dword [0x101434ac], 0x10
jne 0x10004368
push esi
push str.get_g_ChromeFile__s_
push 0
call fcn.1003dfed
add esp, 0xc
mov ebx, dword [ebp + 0x64]
add ebx, 0xfffffffe
js 0x1000438c
mov edi, dword [ebp + ebx*4 - 0x1ac]
test edi, edi
je 0x1000438c
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100043bf
sub ebx, 2
jns 0x10004370
and dword [ebp + 0x70], 0
mov edi, esi
xor esi, esi
cmp edi, esi
je 0x100043b7
push esi
push esi
push esi
push dword [ebp + 0x70]
mov ecx, 0x10196498
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.100379c5
test eax, eax
jne 0x100048bd
inc dword [ebp + 0x6c]
jmp 0x100042d8
cmp dword [0x101434ac], 0x10
jne 0x100043d8
push edi
push str.found_Send__s_
push 0
call fcn.1003dfed
add esp, 0xc
push edi
call fcn.10007344
pop ecx
mov dword [ebp + 0x70], eax
jmp 0x10004392
cmp byte [ebp + 0x2988], 0
je 0x10004420
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x10004405
cmp eax, 0x10
je 0x10004405
cmp eax, 2
jne 0x100048cc
lea eax, [ebp + 0x2988]
push eax
push str._NIE_GetPackFileName_exit_sTC_Chrome_D__s_
push 0
call fcn.1003dfed
add esp, 0xc
jmp 0x100048cc
cmp byte [0x102bc549], 0
mov dword [ebp + 0x80], 0x7d0
je 0x1000443d
mov dword [ebp + 0x80], 0x2ee0
test byte [0x1013dc2c], 0x10
jne 0x10004450
add dword [ebp + 0x80], 0x36ee80
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x10004464
cmp eax, 0x10
je 0x10004464
cmp eax, 2
jne 0x10004476
push dword [ebp + 0x64]
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay_nCount__d_
push 0
call fcn.1003dfed
add esp, 0xc
mov eax, dword [ebp + 0x64]
add eax, 0xfffffffe
mov dword [ebp + 0x6c], eax
js 0x100048cc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10004490
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov esi, dword [ebp + eax - 0x1ac]
test esi, esi
je 0x100048cc
push dword [ebp + eax - 0x1a8]
call fcn.10041c94
mov edi, eax
mov eax, dword [0x101434ac]
pop ecx
cmp eax, 3
je 0x100044c5
cmp eax, 0x10
je 0x100044c5
cmp eax, 2
jne 0x100044d6
push edi
push esi
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_member_chk_one__s_iOpenTime__d_
push 0
call fcn.1003dfed
add esp, 0x10
sub dword [ebp + 0x6c], 2
push esi
call fcn.10007344
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x80]
pop ecx
add edi, eax
call ebx
cmp edi, eax
jb 0x10004549
push esi
call fcn.1002abf8
pop ecx
test eax, eax
jne 0x10004549
xor edi, edi
cmp esi, edi
je 0x10004528
cmp esi, 1
je 0x10004528
cmp byte [esi], 0
je 0x10004528
push edi
push edi
push edi
push dword [ebp + 0x70]
mov ecx, 0x10196498
push esi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.100379c5
test eax, eax
jne 0x10004580
mov eax, dword [0x10144edc]
cmp eax, 0x40
jb 0x1000453d
jbe 0x10004571
cmp byte [0x102bc549], 0
je 0x10004571
add dword [ebp + 0x80], 0x1f4
jmp 0x10004571
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x1000455d
cmp eax, 0x10
je 0x1000455d
cmp eax, 2
jne 0x10004571
push esi
call ebx
push eax
push edi
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_continue_iOpenTime__mytime__d____GetTickCount__d___s_
push 0
call fcn.1003dfed
add esp, 0x14
cmp dword [ebp + 0x6c], 0
jge 0x1000448d
jmp 0x100048cc
mov eax, dword [ebp + 0x68]
mov dword [eax], edi
jmp 0x100048c2
cmp eax, ecx
jne 0x10004728
cmp byte [0x10092cf8], 0
jne 0x10004728
test byte [0x1013dc2c], 1
je 0x100046b1
cmp dword [0x10144ed4], ecx
je 0x100045c0
cmp dword [0x10144ed8], ecx
je 0x100046b1
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x100045d4
cmp eax, 0x10
je 0x100045d4
cmp eax, 2
jne 0x10004608
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str._OpenedList__d:_d:_d:_d:_d:_d:_d:_d:_d:_d_
push 0
call fcn.1003dfed
mov eax, dword [0x101434ac]
add esp, 0x30
xor ecx, ecx
xor edi, edi
jmp 0x10004611
mov eax, dword [0x101434ac]
lea esi, [ebp + edi*4 - 0x1c]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x100048cc
mov edx, ecx
imul edx, edx, 0x1210
lea edx, [edx + 0x1017207c]
cmp byte [edx], 0
je 0x100048cc
cmp eax, 3
je 0x10004646
cmp eax, 0x10
je 0x10004646
cmp eax, 2
jne 0x1000465b
push edx
push dword [ebp + 0x78]
push ecx
push edi
push str._NIE_GetPackFileName_TC_SECURITY_COMM_RAW_SendInfoDisplayPack__d___d__0x_08x___s_
push 0
call fcn.1003dfed
add esp, 0x18
mov eax, dword [esi]
imul eax, eax, 0x1210
add eax, 0x1017207c
push eax
call fcn.1002abf8
pop ecx
test eax, eax
jne 0x100046a2
mov eax, dword [esi]
imul eax, eax, 0x1210
push 0
push dword [eax + 0x1017227c]
lea eax, [eax + 0x1017207c]
push eax
push dword [ebp + 0x78]
mov ecx, 0x10196498
push dword [ebp + 0x7c]
call fcn.1003a51d
test eax, eax
jne 0x10004175
inc edi
cmp edi, 0x20
jl 0x1000460c
jmp 0x100048cc
cmp dword [ebp + 0x80], ecx
je 0x100048cc
cmp dword [ebp + 0x80], 1
je 0x100048cc
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x100046de
cmp eax, 0x10
je 0x100046de
cmp eax, 2
jne 0x100046f6
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push str._NIE_GetPackFileName_SendInfoDisplay_else_0x_08x___s_
push 0
call fcn.1003dfed
add esp, 0x10
mov eax, dword [ebp + 0x80]
cmp byte [eax], 0
je 0x100048cc
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x70]
mov ecx, 0x10196498
push dword [ebp + 0x80]
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.100379c5
jmp 0x1000416d
mov eax, dword [0x101434ac]
cmp eax, 3
je 0x1000473c
cmp eax, 0x10
je 0x1000473c
cmp eax, 2
jne 0x10004752
push 0x10092cf8
push str._NIE_GetPackFileName_g_sbIsMultiProcessXfer_SendInfoDisplay_g_sIE_Edit__s_
push 0
call fcn.1003dfed
add esp, 0xc
xor ecx, ecx
xor eax, eax
mov cl, byte [eax + 0x10092cf8]
mov byte [ebp + eax + 0x2988], cl
inc eax
test cl, cl
jne 0x10004754
push 0x84
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.10040850
push 0x200
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x2988]
push 0x1005d40c
push eax
call fcn.1003d3e7
and dword [ebp + 0x64], 0
add esp, 0x1c
mov dword [ebp + 0x6c], eax
test eax, eax
jle 0x100048cc
mov eax, dword [ebp + 0x64]
cmp eax, dword [ebp + 0x6c]
jge 0x100048cc
mov esi, dword [ebp + eax*4 - 0xa0]
test esi, esi
je 0x100048cc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100047c8
sub eax, edx
cmp eax, 1
jbe 0x100048cc
cmp byte [esi], 0x22
jne 0x100047e0
inc esi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100047e5
sub eax, edx
cmp byte [eax + esi - 1], 0x20
jne 0x1000481c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100047fa
sub eax, edx
cmp byte [eax + esi - 2], 0x22
jne 0x1000481c
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000480f
sub eax, ecx
mov byte [eax + esi - 2], dl
cmp dword [0x101434ac], 0x10
jne 0x10004835
push esi
push str.get_g_ChromeFile__s_
push 0
call fcn.1003dfed
add esp, 0xc
mov ebx, dword [0x1019627c]
jmp 0x10004856
cmp ebx, 0x20
jge 0x10004869
mov edi, eax
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x10004898
dec ebx
jns 0x10004856
push 0x1f
pop ebx
mov eax, ebx
imul eax, eax, 0x1210
lea eax, [eax + 0x1017207c]
cmp byte [eax], 0
jne 0x1000483d
and dword [ebp + 0x70], 0
mov edi, esi
xor esi, esi
cmp edi, esi
je 0x10004890
push esi
push esi
push esi
push dword [ebp + 0x70]
mov ecx, 0x10196498
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call fcn.100379c5
test eax, eax
jne 0x100048bd
inc dword [ebp + 0x64]
jmp 0x100047a8
cmp dword [0x101434ac], 0x10
jne 0x100048b1
push edi
push str.found_Send_IE__s_
push 0
call fcn.1003dfed
add esp, 0xc
push edi
call fcn.10007344
pop ecx
mov dword [ebp + 0x70], eax
jmp 0x1000486f
mov eax, dword [ebp + 0x68]
mov dword [eax], esi
mov eax, dword [ebp + 0x74]
mov byte [eax + 0x1218], 1
mov al, 1
mov ecx, dword [ebp + 0x2c94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x2c98
leave
ret 0xc