Function at 0x102e3b7
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
mov eax, reloc.ADVAPI32.dll_AddAccessAllowedAce
call fcn.01077868
sub esp, 0x154
mov eax, dword [0x10de03c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], ebx
call fcn.01075fa4
mov ecx, dword [eax + 4]
call fcn.010584d3
mov edi, eax
mov dword [ebp - 0x5c], edi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [0x10e00f4], ebx
mov dword [0x10e2598], ebx
mov dword [0x10e00fc], ebx
mov byte [0x10e25c4], bl
mov byte [0x10e0210], bl
call fcn.01082224
movsx eax, word [ebp + 8]
xor esi, esi
inc esi
mov dword [0x10e00f8], ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
mov dword [0x10e0114], eax
mov dword [0x10e010c], esi
call fcn.0102150d
mov eax, dword [eax + 0x2b4]
push 3
cdq
pop ecx
idiv ecx
mov dword [0x10e259c], ebx
mov dword [0x10e20f4], esi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], ax
lea eax, [ebp - 0x4c]
push eax
call fcn.0102aedf
test eax, eax
jne 0x102e48d
push esi
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.0101727b
mov ecx, dword [eax + 0xd4]
call fcn.0107607c
jmp 0x102ef09
cmp dword [ebp - 0x4c], ebx
je 0x102e4b1
push esi
call fcn.0101727b
mov ecx, dword [eax + 0xd4]
call fcn.0107607c
push 4
pop eax
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], ax
jmp 0x102ef10
call fcn.0101727b
push edi
push ebx
push 0x401
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
push 0x80f8
call fcn.01064b82
call fcn.0104e929
test eax, eax
jne 0x102edd0
call fcn.01077cf5
test ax, ax
je 0x102edd0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x54], 0xa
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.01077df6
mov eax, dword [edi + 0x5c]
cmp eax, ebx
je 0x102e63b
lea eax, [ebp - 0x20]
push eax
call fcn.01077d0f
test ax, ax
jne 0x102e640
call fcn.0104e959
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x44], ebx
call fcn.01081f35
cmp eax, ebx
mov dword [ebp - 0x48], eax
je 0x102e683
cmp dword [ebp - 0x44], ebx
jne 0x102e597
push dword [ebp - 0x48]
call fcn.01081f21
cmp eax, ebx
mov dword [ebp - 0x44], eax
je 0x102e588
mov edi, dword [ebp - 0x44]
push 4
add edi, 0x38
pop ecx
lea esi, [ebp - 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x102e583
push dword [ebp - 0x44]
call fcn.01081f40
cmp eax, ebx
mov dword [ebp - 0x44], eax
jne 0x102e562
cmp dword [ebp - 0x44], ebx
jne 0x102e597
push dword [ebp - 0x48]
call fcn.01081f40
cmp eax, ebx
mov dword [ebp - 0x48], eax
jne 0x102e54e
cmp dword [ebp - 0x48], ebx
je 0x102e683
cmp dword [ebp - 0x50], ebx
je 0x102e683
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x50]
lea eax, [esi + 0x3c]
push eax
push dword [edi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x102e5d0
push edi
call fcn.0104e96e
inc dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
jmp 0x102e5a0
cmp edi, ebx
je 0x102e683
push dword [ebp - 0x58]
call fcn.0104f182
add esi, 0x3c
push esi
lea ecx, [ebp - 0x4c]
call fcn.01075f08
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x4c]
push eax
add ecx, 0x78
mov dword [ebp - 4], ebx
call fcn.01075efc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.01075ef0
push 0x50
push esi
call fcn.0102150d
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
call fcn.0102150d
mov word [eax + 0xa0], bx
call fcn.0104eff3
call fcn.0102150d
mov word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 1
call fcn.0104fbdf
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x5c]
cmp eax, ebx
je 0x102e660
push 0xa
pop esi
call fcn.01075adf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x102e64d
lea eax, [ebp - 0x20]
push eax
call fcn.01077d0f
test ax, ax
jne 0x102e89d
lea eax, [ebp - 0x20]
push eax
call fcn.0107b02e
xor edi, edi
inc edi
jmp 0x102e822
xor esi, esi
inc esi
push esi
push ebx
push 0x30
push ebx
push 0x449
push 0x17
call fcn.01054bf6
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e6c1
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01066303
push esi
call fcn.0101727b
mov ecx, dword [eax + 0xd4]
call fcn.0107607c
mov eax, esi
jmp 0x102ef10
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x5c], ebx
je 0x102e7aa
call fcn.01075adf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jg 0x102e819
push ebx
call fcn.01077d4d
call fcn.0102150d
cmp word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x102e71c
call fcn.0102ab55
push edi
push ebx
call fcn.0107f550
mov esi, eax
cmp esi, ebx
je 0x102eddd
call fcn.01075adf
cmp esi, 0x3e3
je 0x102e764
push ebx
push ebx
push ebx
call fcn.01050ed2
push 0x1f4
push edi
push edi
push ebx
call fcn.01050ed2
push 0xd37
call fcn.010816e4
push 8
push ebx
call fcn.01050ed2
add esp, 0x28
call fcn.0101727b
cmp eax, ebx
je 0x102e779
mov ecx, dword [eax + 0xd4]
push edi
call fcn.0107607c
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e7a3
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01066303
mov eax, edi
jmp 0x102ef10
lea eax, [ebp - 0x20]
push eax
call fcn.0107a984
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.01075f2c
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], edi
call fcn.01075f2c
push ebx
push esi
push 0x44a
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.01016fe5
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 3
call fcn.01054c7c
cmp eax, edi
jne 0x102e830
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.01017205
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075ef0
lea eax, [ebp - 0x20]
push eax
call fcn.0107b02e
test ax, ax
je 0x102e6d9
jmp 0x102e703
push ebx
call fcn.01077d4d
push edi
call fcn.0101727b
mov ecx, dword [eax + 0xd4]
call fcn.0107607c
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102e871
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01066303
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.01017205
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075ef0
jmp 0x102e7a3
lea eax, [ebp - 0x40]
push eax
call fcn.0107ab31
push eax
mov dword [ebp - 0x44], eax
call fcn.0107db94
test eax, eax
jne 0x102e95c
lea eax, [ebp - 0x30]
push eax
call fcn.01079ca0
test ax, ax
je 0x102e95c
push ebx
lea ecx, [ebp - 0xd8]
call fcn.010749a8
push ebx
mov dword [ebp - 4], 4
call fcn.0101727b
mov ecx, eax
call fcn.0107607c
push ebx
push 0x4ef0
lea ecx, [ebp - 0xd8]
call fcn.010769dc
push ebx
lea ecx, [ebp - 0xd8]
call fcn.010766dc
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0xd8]
call fcn.01076358
call fcn.01075adf
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
call fcn.01079dfb
test ax, ax
jne 0x102e915
lea ecx, [ebp - 0xd8]
call fcn.01075df4
push edi
call fcn.0101727b
mov ecx, eax
call fcn.0107607c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.01075ee4
jmp 0x102eceb
xor edi, edi
inc edi
jmp 0x102eceb
mov esi, dword [ebp - 0x5c]
cmp dword [esi + 0x5c], ebx
je 0x102e983
call fcn.0102150d
mov eax, dword [eax + 0xb90]
test byte [eax + 0x9f], 1
mov dword [ebp - 0x48], edi
jne 0x102e986
mov dword [ebp - 0x48], ebx
mov eax, dword [esi + 0x5c]
cmp eax, ebx
mov dword [ebp - 0x4c], eax
je 0x102e9b3
cmp dword [ebp - 0x48], ebx
jne 0x102e9b3
call fcn.01075adf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jle 0x102e703
push dword [ebp - 0x44]
call fcn.0107cb41
mov esi, eax
cmp esi, ebx
je 0x102eaea
lea ecx, [ebp - 0x74]
call fcn.01075f2c
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 5
call fcn.01075f2c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075f2c
push 0x44c
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.01075f5c
push 0x64
push 0x64
lea ecx, [ebp - 0x68]
call fcn.010763d0
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010793c9
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
call fcn.010763c4
push dword [ebp - 0x68]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.01075f50
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102ea5c
cmp dword [ebp - 0x4c], ebx
je 0x102ea47
lea eax, [esi + 0x14]
push eax
call fcn.0107b0e9
test ax, ax
je 0x102ea5c
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x74]
push 0x17
call fcn.01054b96
cmp eax, 6
jne 0x102eac6
push esi
call fcn.0107e497
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
jmp 0x102ea88
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x493e0
jae 0x102ea94
call fcn.01075adf
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x44]
call fcn.0107db94
test eax, eax
je 0x102ea6c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x493e0
jb 0x102ed00
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x5c], ebx
jne 0x102eac6
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push 0xfad
push 0x17
call fcn.01054bf6
cmp eax, 6
je 0x102ea62
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075ef0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.01075ef0
push dword [ebp - 0x44]
call fcn.0107cbba
mov esi, eax
cmp esi, ebx
je 0x102ebb1
lea ecx, [ebp - 0x70]
call fcn.01075f2c
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 8
call fcn.01075f2c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075f2c
push 0x44d
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.01075f5c
push 0x64
push 0x64
lea ecx, [ebp - 0x64]
call fcn.010763d0
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010793c9
push 0xffffffffffffffff
lea ecx, [ebp - 0x64]
call fcn.010763c4
push dword [ebp - 0x64]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
call fcn.01075f50
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102ed1d
cmp dword [ebp - 0x4c], ebx
jne 0x102eb8d
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x70]
push 0x17
call fcn.01054b96
cmp eax, 6
je 0x102ed1d
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075ef0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.01075ef0
push dword [ebp - 0x44]
call fcn.0107cc33
mov esi, eax
cmp esi, ebx
je 0x102ec8a
lea eax, [esi + 0x14]
push eax
call fcn.0107b0e9
test ax, ax
jne 0x102ec8a
lea ecx, [ebp - 0x50]
call fcn.01075f2c
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], LoadLibraryW
call fcn.01075f2c
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075f2c
push 0x44e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], LoadLibraryW
call fcn.01075f5c
push 0x64
push 0x64
lea ecx, [ebp - 0x60]
call fcn.010763d0
push eax
lea eax, [esi + 0x24]
push eax
call fcn.010793c9
push 0xffffffffffffffff
lea ecx, [ebp - 0x60]
call fcn.010763c4
push dword [ebp - 0x60]
lea eax, [esi + 0x58]
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x50]
push eax
call fcn.01075f50
add esp, 0x10
cmp dword [ebp - 0x48], ebx
jne 0x102ed49
cmp dword [ebp - 0x4c], ebx
jne 0x102ec66
push edi
push ebx
push reloc.ADVAPI32.dll_ReadEncryptedFileRaw
push 4
push dword [ebp - 0x50]
push 0x17
call fcn.01054b96
cmp eax, 6
je 0x102ed49
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075ef0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.01075ef0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.01075ef0
cmp dword [ebp - 0x48], ebx
je 0x102ecaf
call fcn.01075adf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
jle 0x102e703
jmp 0x102eceb
push ebx
push ebx
push 0x44b
lea ecx, [ebp - 0x160]
call fcn.01016fe5
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 4], LoadLibraryW
call fcn.01054c7c
cmp eax, edi
jne 0x102ed7b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.01017205
push dword [ebp - 0x44]
call fcn.0107db94
test eax, eax
je 0x102e964
jmp 0x102e703
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.01075ef0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.01075ef0
lea ecx, [ebp - 0x74]
jmp 0x102ed6d
push esi
call fcn.0107ca29
add esi, 0x14
push esi
call fcn.01077dcc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.01075ef0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.01075ef0
lea ecx, [ebp - 0x70]
jmp 0x102ed6d
add esi, 0x14
push esi
call fcn.01077dcc
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.01075ef0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.01075ef0
lea ecx, [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
call fcn.01075ef0
jmp 0x102e703
push ebx
call fcn.01077d4d
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax + 0xc4]
cmp ecx, ebx
je 0x102edab
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.01066303
push edi
call fcn.0101727b
mov ecx, dword [eax + 0xd4]
call fcn.0107607c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.01017205
jmp 0x102e7a3
call fcn.01075adf
call fcn.0104fbdf
xor edi, edi
inc edi
mov eax, dword [0x10e25b4]
mov esi, dword [eax + 4]
jmp 0x102ee05
mov eax, dword [0x10e25bc]
mov dword [esi + 0x98], eax
call fcn.0104e929
test eax, eax
je 0x102ee02
or byte [esi + 0xa0], 8
mov esi, dword [esi + 4]
cmp esi, ebx
jne 0x102ede7
xor eax, eax
mov ax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010322ac
call fcn.0102e240
cmp dword [0x10e01fc], ebx
je 0x102ee4b
push ebx
push ebx
push ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], di
call fcn.01050ed2
push reloc.KERNEL32.dll_GetProcessHeap
push edi
push edi
push ebx
call fcn.01050ed2
push 8
push ebx
call fcn.01050ed2
add esp, 0x24
mov ecx, dword [ebp - 0x5c]
call fcn.010745c4
test eax, eax
je 0x102ee6c
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], di
jne 0x102eea8
mov ecx, dword [ebp - 0x5c]
call fcn.010745c4
test eax, eax
je 0x102eea8
mov ecx, dword [ebp - 0x5c]
push ebx
call fcn.0102ac08
call fcn.01075fa4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x20]
xor ecx, ecx
mov cx, word [reloc.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, dword [eax + 0xc4]
call fcn.01066303
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
je 0x102eea8
call fcn.0104ec90
call fcn.0107af9e
push dword [0x10e00f8]
call fcn.010846d5
mov dword [0x10e20f4], ebx
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], bx
call fcn.0107f0f8
call fcn.0108b8db
call fcn.0101727b
mov eax, dword [eax + 0xd4]
mov ecx, dword [eax + 0x88]
add ecx, 0x388
call fcn.0101ef06
push 0x10e0218
call fcn.01024c81
push 0x10e021c
call fcn.01024c81
push 0x10e0220
call fcn.01024c81
call fcn.01082224
movsx eax, word [reloc.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01075bbb
leave
ret 4