Function at 0x100224f0
Capabilities:
Check for time delay via gettickcount
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027aab
mov eax, dword fs:[0]
push eax
sub esp, 0xf1c
mov eax, dword [0x10031118]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf20], ecx
mov eax, dword [ebp - 0xf20]
add eax, 8
push eax
lea ecx, [ebp - 0xabc]
call fcn.10003d60
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xf20]
add ecx, 0x64
push ecx
lea ecx, [ebp - 0xabc]
call fcn.10003e00
mov edx, dword [ebp - 0xf20]
cmp dword [edx + 0xec4], 0
je 0x10022573
push str..exe
lea ecx, [ebp - 0xabc]
call fcn.10003e20
jmp 0x10022583
push str..dll
lea ecx, [ebp - 0xabc]
call fcn.10003e20
mov word [ebp - 0x43c], 0
push 0x206
push 0
lea eax, [ebp - 0x43a]
push eax
call fcn.1000c7f0
add esp, 0xc
mov word [ebp - 0x86c], 0
push 0x206
push 0
lea ecx, [ebp - 0x86a]
push ecx
call fcn.1000c7f0
add esp, 0xc
lea ecx, [ebp - 0xa98]
call fcn.10003cf0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xf20]
add edx, 0x24
push edx
lea ecx, [ebp - 0xa98]
call fcn.10003dc0
mov byte [ebp - 0x86d], 0
lea ecx, [ebp - 0xa98]
call fcn.10006630
movzx eax, al
test eax, eax
je 0x100226ef
lea ecx, [ebp - 0xcc8]
call fcn.10005940
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc8]
push ecx
mov ecx, dword [ebp - 0xf20]
call fcn.10021610
test eax, eax
je 0x1002264a
lea ecx, [ebp - 0xcc8]
call fcn.10008440
push eax
lea ecx, [ebp - 0xa98]
call fcn.10003de0
mov byte [ebp - 0x86d], 1
jmp 0x100226e0
mov word [ebp - 0xedc], 0
push 0x208
push 0
lea edx, [ebp - 0xeda]
push edx
call fcn.1000c7f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xedc]
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0xee0]
call fcn.10005940
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xedc]
push ecx
push 0x1002cec8
lea edx, [ebp - 0xee0]
push edx
call fcn.10005570
add esp, 0xc
push str.BaiduBaiduAn
lea ecx, [ebp - 0xee0]
call fcn.10006bd0
lea ecx, [ebp - 0xee0]
call fcn.10008440
push eax
lea ecx, [ebp - 0xa98]
call fcn.10003de0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xee0]
call fcn.10005980
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc8]
call fcn.10005980
mov eax, dword [0x1002d97c]
push eax
push str.BaiduAn
lea ecx, [ebp - 0xa98]
call fcn.100066a0
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xaa0]
cmp ecx, dword [0x1002d97c]
je 0x1002277b
mov edx, dword [ebp - 0xaa0]
push edx
push 0
lea eax, [ebp - 0xf1c]
push eax
lea ecx, [ebp - 0xa98]
call fcn.100066f0
mov dword [ebp - 0xf24], eax
mov ecx, dword [ebp - 0xf24]
mov dword [ebp - 0xf28], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xf28]
push edx
lea ecx, [ebp - 0xa98]
call fcn.10003dc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf1c]
call fcn.10003da0
push str.BaiduAn2.3BaiduAn
lea ecx, [ebp - 0xa98]
call fcn.10003e20
lea ecx, [ebp - 0xa9c]
call fcn.10005940
mov byte [ebp - 4], 5
mov dword [0x10033610], 3
movzx eax, byte [ebp - 0x86d]
neg eax
sbb eax, eax
neg eax
mov dword [0x10033614], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100335dc]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x10033618], eax
mov ecx, 0x10033608
call fcn.10026380
test eax, eax
je 0x100227d8
mov ecx, 0x10033608
call fcn.10025fe0
lea ecx, [ebp - 0xa98]
call fcn.10003fa0
push eax
mov edx, dword [ebp - 0xf20]
mov eax, dword [edx + 0x54]
push eax
push str._supplyid_d__installmode2__startmain1__silent1___D_s
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xa98]
call fcn.10003fa0
push eax
mov edx, dword [ebp - 0xf20]
mov eax, dword [edx + 0x54]
push eax
push str._supplyid_d__installmode2__startmain1__S___D_s
lea ecx, [ebp - 0x86c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edx, dword [str.50210]
mov dword [ebp - 0xcc4], edx
mov eax, dword [0x1002d00c]
mov dword [ebp - 0xcc0], eax
mov ecx, dword [0x1002d010]
mov dword [ebp - 0xcbc], ecx
push 0x1fc
push 0
lea edx, [ebp - 0xcb8]
push edx
call fcn.1000c7f0
add esp, 0xc
mov eax, dword [str.2.3.0.2225]
mov dword [ebp - 0x664], eax
mov ecx, dword [0x1002d018]
mov dword [ebp - 0x660], ecx
mov edx, dword [0x1002d01c]
mov dword [ebp - 0x65c], edx
mov eax, dword [0x1002d020]
mov dword [ebp - 0x658], eax
mov ecx, dword [0x1002d024]
mov dword [ebp - 0x654], ecx
mov dx, word [0x1002d028]
mov word [ebp - 0x650], dx
push 0x1f2
push 0
lea eax, [ebp - 0x64e]
push eax
call fcn.1000c7f0
add esp, 0xc
mov word [ebp - 0xa7c], 0
push 0x206
push 0
lea ecx, [ebp - 0xa7a]
push ecx
call fcn.1000c7f0
add esp, 0xc
push str._toolsi.7z
mov edx, dword [ebp - 0xf20]
add edx, 8
push edx
lea eax, [ebp - 0x458]
push eax
call fcn.10006940
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x458]
call fcn.10003fa0
push eax
push 0x104
lea ecx, [ebp - 0xa7c]
push ecx
call fcn.1000d428
add esp, 0xc
lea edx, [ebp - 0xa98]
push edx
lea ecx, [ebp - 0x2c]
call fcn.10003d60
mov byte [ebp - 4], 7
push 0x1002d044
lea ecx, [ebp - 0x2c]
call fcn.10003e20
mov word [ebp - 0x234], 0
push 0x206
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.1000c7f0
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.10003fa0
push eax
push 0x104
lea ecx, [ebp - 0x234]
push ecx
call fcn.1000d428
add esp, 0xc
mov dword [ebp - 0x874], 0
mov edx, dword [ebp - 0xf20]
cmp dword [edx + 0xec4], 0
je 0x10022a69
lea ecx, [ebp - 0xabc]
call fcn.10003fa0
push eax
mov ecx, dword [ebp - 0xf20]
call fcn.10021990
push 0
mov ecx, dword [ebp - 0xf20]
add ecx, 0x80
call fcn.10006260
movzx eax, al
test eax, eax
je 0x10022a46
lea ecx, [ebp - 0x43c]
push ecx
mov ecx, dword [ebp - 0xf20]
add ecx, 0x80
call fcn.100062a0
movzx edx, al
test edx, edx
je 0x10022a0d
push 0
lea ecx, [ebp - 0xabc]
call fcn.10003fa0
push eax
call fcn.10024780
add esp, 8
mov dword [ebp - 0x874], eax
jmp 0x10022a2e
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0xabc]
call fcn.10003fa0
push eax
call fcn.10024780
add esp, 8
mov dword [ebp - 0x874], eax
push 0x2710
mov ecx, dword [ebp - 0xf20]
add ecx, 0x80
call fcn.10006350
jmp 0x10022a67
lea ecx, [ebp - 0x86c]
push ecx
lea ecx, [ebp - 0xabc]
call fcn.10003fa0
push eax
call fcn.10024780
add esp, 8
mov dword [ebp - 0x874], eax
jmp 0x10022a9f
lea edx, [ebp - 0xa7c]
push edx
lea eax, [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x664]
push edx
lea ecx, [ebp - 0xabc]
call fcn.10003fa0
push eax
call fcn.10024620
add esp, 0x14
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jne 0x10022af3
mov dword [0x10033610], 4
mov dword [0x10033614], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100335dc]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x10033618], eax
mov ecx, 0x10033608
call fcn.10026380
test eax, eax
je 0x10022aee
mov ecx, 0x10033608
call fcn.10025fe0
jmp 0x10022bd2
lea edx, [ebp - 0xa9c]
push edx
call fcn.10024b20
add esp, 4
lea ecx, [ebp - 0xf00]
call fcn.10005940
mov byte [ebp - 4], 8
lea eax, [ebp - 0xf00]
push eax
mov ecx, dword [ebp - 0xf20]
call fcn.10021610
lea ecx, [ebp - 0xa9c]
call fcn.100065f0
push eax
lea ecx, [ebp - 0xefc]
call fcn.10003d20
mov byte [ebp - 4], 9
mov dword [0x10033610], 4
push 0x1002d048
lea ecx, [ebp - 0xefc]
push ecx
call fcn.100069d0
add esp, 8
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov dword [0x10033614], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100335dc]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x10033618], eax
lea ecx, [ebp - 0xf00]
call fcn.100065f0
push eax
mov ecx, 0x10033638
call fcn.10003de0
mov ecx, 0x10033608
call fcn.10026380
test eax, eax
je 0x10022bb4
mov ecx, 0x10033608
call fcn.10025fe0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xefc]
call fcn.10003da0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf00]
call fcn.10005980
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.10003da0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x458]
call fcn.10003da0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa9c]
call fcn.10005980
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa98]
call fcn.10003da0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xabc]
call fcn.10003da0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bfdf
mov esp, ebp
pop ebp
ret