Function at 0x100209d0
Capabilities:
Check for time delay via gettickcount
Create thread
Terminate process

Disassembly:
sub esp, 0x60c
mov eax, dword [0x10083adc]
xor eax, esp
mov dword [esp + 0x608], eax
push ebx
push ebp
push esi
push edi
mov ebp, 0x1ff
xor ebx, ebx
push ebp
lea eax, [esp + 0x1d]
push ebx
push eax
mov byte [esp + 0x24], bl
call fcn.10044b80
lea edi, [ebp + 1]
push edi
lea eax, [esp + 0x28]
push eax
push str.TC_TCServer
mov esi, str.SOFTWARE_trueEP_tc_INSTALL
push esi
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10020a29
mov byte [esp + 0x18], bl
push ebp
lea eax, [esp + 0x21d]
push ebx
push eax
mov byte [esp + 0x224], bl
call fcn.10044b80
push edi
lea eax, [esp + 0x228]
push eax
push str.TC_PatchServer
push esi
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10020a67
mov byte [esp + 0x218], bl
lea eax, [esp + 0x18]
push 0x2e
push eax
mov byte [0x101570e7], 1
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x10020a86
cmp byte [esp + 0x18], bl
jne 0x10020a8c
mov byte [0x101570e7], bl
lea eax, [esp + 0x218]
push 0x2e
push eax
call fcn.10044a60
pop ecx
pop ecx
test eax, eax
jne 0x10020aaa
cmp byte [esp + 0x218], bl
jne 0x10020ab0
mov byte [0x101570e7], bl
cmp byte [0x101570e7], bl
je 0x10020b51
mov esi, 0x81
push esi
mov ebp, 0x1014e518
push ebp
push str.PEeurT
push str.Software_trueEP
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020aef
push esi
push ebx
push ebp
call fcn.10044b80
add esp, 0xc
push edi
mov esi, 0x1014cf18
push esi
push str.PEeurTPEeurT
push str.Software_trueEP
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020b1d
push edi
push ebx
push esi
call fcn.10044b80
add esp, 0xc
push 0x101121a8
push esi
push ebp
push ebx
call fcn.1003529b
add esp, 0x10
push str.takeown
push 0x10154228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10020b51
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push str.tc_Log
push str.SOFTWARE_trueEP_tc_Env
mov esi, reloc.WS2_32.dll_bind
push esi
call fcn.10040c17
add esp, 0x10
mov dword [0x1015568c], eax
cmp eax, ebx
je 0x10020b82
push eax
push str.StartUp...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
push 0x100686bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push str.tc_PCTIME
push str.SOFTWARE_trueEPTC_Env_tc_CLIENT
push esi
mov dword [esp + 0x24], eax
call fcn.10040c17
mov ecx, eax
add esp, 0x10
and ecx, 0x40
mov dword [0x101570d8], eax
mov byte [0x102d2d90], bl
je 0x10020bef
test al, al
jns 0x10020bcd
test edi, eax
je 0x10020bc6
test eax, 0x100
je 0x10020be8
test eax, 0x40000
jmp 0x10020be0
test eax, 0x8000
je 0x10020bdb
test eax, 0x4000
je 0x10020be8
test eax, 0x4000000
mov byte [0x102d2d90], bl
je 0x10020bef
mov byte [0x102d2d90], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov byte [0x102d2d91], bl
mov esi, 0x10154428
cmp ecx, ebx
je 0x10020c1b
test al, al
jns 0x10020c0d
shr eax, 0x12
jmp 0x10020c10
shr eax, 0x1a
and al, 1
mov byte [0x102d2d91], al
cmp al, bl
jne 0x10020c4b
push ebx
push esi
call ebp
push eax
call fcn.10044688
add esp, 0xc
test eax, eax
je 0x10020c4b
mov eax, dword [0x1015568c]
cmp eax, 4
je 0x10020c41
cmp eax, 0x99
jne 0x10021083
push str.IsProcessCritical_OK_noHook
jmp 0x1002107b
push 0x4100
push 0x10148e18
call fcn.10007867
push esi
call fcn.1002f133
add esp, 0xc
test al, al
je 0x10020c7d
cmp dword [0x1015568c], ebx
je 0x10021083
push str.isDefaultStaticWhite_OK_NOBHKOK
jmp 0x1002107b
mov esi, 0x10154e28
push esi
push 0x10154228
call fcn.100402d9
push edi
push 0x10154a28
call fcn.10046842
push edi
push esi
call fcn.10046842
add esp, 0x18
xor eax, eax
mov cl, byte [eax + 0x10154e28]
mov byte [eax + 0x10155028], cl
inc eax
cmp cl, bl
jne 0x10020ca4
push 0x10155028
call fcn.10044e58
push ebx
push str.tc_logx
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10040c17
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x10020d27
push edi
lea eax, [esp + 0x41c]
push eax
push str.tc_logXp
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.1004171d
add esp, 0x14
cmp eax, 0xffffffff
jne 0x10020d09
mov byte [esp + 0x418], bl
lea eax, [esp + 0x418]
push eax
push 0x10154a28
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
jne 0x10020d27
mov dword [0x1015568c], esi
call fcn.1000d583
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x2800
push ebx
push 0x1017d570
mov dword [0x10184a50], eax
call fcn.10044b80
push 0x1000
push ebx
push 0x1017fd78
call fcn.10044b80
add esp, 0x18
call ebp
push str.explorer.exeiexplore.exechrome.exewhale.exeswing.exeoutlook.exealzip.exebandizip.exebreadzip.exe7z.exewinrar.exewinzip.exewlmail.exemsimn.exemicrosoftedge.exemicrosoftedgecp.exefirefox.exeopera.exesafari.exewebkit2webprocess.exewscript.execscript.execonhost.execmd.exepowershell.exepowershell_ise.exeucbrowser.exespark.exe
mov dword [0x10150830], eax
call fcn.1002d7c4
push dword [0x10184a50]
call fcn.1002c37c
push eax
mov dword [0x10184a54], eax
call fcn.1002c37c
push eax
mov dword [0x10184a58], eax
call fcn.1002c37c
push eax
mov dword [0x10184a5c], eax
call fcn.1002c37c
add esp, 0x14
mov dword [0x10184a60], eax
cmp dword [0x101524e8], ebx
je 0x10020dfb
mov ecx, 0x101524e8
cmp ecx, 0x10152560
jge 0x10020dfb
mov eax, dword [ecx]
cmp eax, ebx
je 0x10020dfb
cmp eax, dword [0x10184a54]
jne 0x10020dd6
mov dword [0x10184a54], ebx
mov dword [0x10184a58], ebx
mov dword [0x10184a5c], ebx
jmp 0x10020dee
cmp eax, dword [0x10184a58]
je 0x10020dc8
cmp eax, dword [0x10184a5c]
je 0x10020dce
cmp eax, dword [0x10184a60]
jne 0x10020df4
mov dword [0x10184a60], ebx
add ecx, 4
cmp dword [ecx], ebx
jne 0x10020dac
or dword [0x101477e4], 0xffffffff
push edi
push ebx
push 0x10156ea8
call fcn.10007858
add esp, 0xc
cmp dword [esp + 0x14], ebx
je 0x1002106e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [0x101570ec], eax
call ebp
mov esi, eax
push esi
call fcn.1002c3f8
test eax, eax
pop ecx
setne al
push esi
mov byte [0x1015088b], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x10020e5c
push eax
push str.StartUp10...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
cmp dword [str._truep.exe], ebx
je 0x10020ea7
mov esi, 0x10082e38
cmp esi, 0x10082eb4
jge 0x10020ea7
mov eax, dword [esi]
cmp byte [eax], bl
je 0x10020ea0
push eax
push 0x10154428
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10020ea0
push str.truEP
push 0x10154228
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002105f
add esi, 4
cmp dword [esi], ebx
jne 0x10020e69
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x10020ebf
push eax
push str.StartUp11...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
mov eax, dword [0x10077cd8]
and eax, 0xf0000
mov dword [0x101570f0], eax
xor eax, eax
mov word [0x10077cda], ax
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x10020eee
push eax
push str.StartUp12...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
call fcn.100111ed
test al, al
je 0x10021083
cmp dword [0x1015568c], ebx
je 0x10020f43
push dword [0x10184a50]
push dword [0x10184a54]
push dword [0x10184a58]
push dword [0x10184a5c]
push dword [0x10184a60]
push 0x10153e28
push 0x10154e28
push 0x10154228
push 0x10154a28
push str.CInjectAPI_Start_g_szMyExeName__s___g_szMyExeFullPath__s___g_szMyExePath__s___g_szDllPath__s_ParentID__d___d___d___d___d_
push ebx
call fcn.1004122a
add esp, 0x2c
call fcn.10031476
test eax, eax
je 0x10021083
call fcn.1001e6d2
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x10020f6d
push eax
push str.StartUp13...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
push str..scr
push 0x10154628
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10020f9b
push 1
push str.tc_Scr
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10041961
add esp, 0x10
cmp dword [0x101570c0], ebx
je 0x10020fae
push 0x101133a8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [0x101570b8], ebx
je 0x10020fbd
call edi
mov dword [0x1014f5f4], eax
cmp byte [0x1014edb9], bl
jne 0x10020fd6
cmp byte [0x1015688a], bl
je 0x10021015
test byte [0x10150864], 0x10
jne 0x10021015
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1000df71
push ebx
push ebx
mov byte [0x1015062f], bl
call fcn.1004547d
add esp, 0x18
mov dword [0x10150878], eax
cmp byte [0x101570e7], bl
je 0x10021015
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1000dedb
push ebx
push ebx
call fcn.1004547d
add esp, 0x18
test dword [0x10156880], 0x80000000
jne 0x10021040
cmp dword [0x10156874], 2
je 0x10021040
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1001e3f7
push ebx
push ebx
call fcn.1004547d
add esp, 0x18
mov eax, dword [0x1015568c]
cmp eax, ebx
je 0x10021058
push eax
push str.StartUp14...g_bLog_0x_08x_
push ebx
call fcn.1004122a
add esp, 0xc
mov eax, 0x89578da3
jmp 0x10021088
cmp dword [0x1015568c], ebx
je 0x10021083
push str.OK_NOBHKOK_Except_Hook2
jmp 0x1002107b
cmp dword [0x1015568c], ebx
je 0x10021083
push str.OK_NOBHKOK_StartUp_hMod_error
push ebx
call fcn.1004122a
pop ecx
pop ecx
mov eax, 0x23785289
mov ecx, dword [esp + 0x618]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10044b6f
add esp, 0x60c
ret