Function at 0x1115bf90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov esi, dword [edi + 0x24]
push ecx
mov dword [ebp - 0x20], ecx
push eax
mov ecx, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
call fcn.11150910
cmp dword [esi + 0x30], 0
jne 0x1115bfde
mov eax, dword [edi]
mov edx, dword [eax + 0xc0]
mov ecx, edi
call edx
test eax, eax
je 0x1115bfde
cmp dword [0x1127ad00], 0
je 0x1115bff2
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
push ebx
push 0
call fcn.111556d0
mov ebx, dword [sym.imp.USER32.dll_OpenInputDesktop]
add esp, 4
push 0x1ef
push 0
push 0
mov dword [ebp - 0x1c], 0
call ebx
mov edi, eax
test edi, edi
jne 0x1115c056
jmp 0x1115c020
cmp dword [esi + 0x34], 0
jne 0x1115c164
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x1e
jg 0x1115c181
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1ef
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x1115c020
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push ebx
push 2
push edi
mov dword [esi + 0x34], 1
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
cmp word [esi + 0x88], 0
je 0x1115c129
test eax, eax
je 0x1115c0ef
mov ecx, str.Winlogon
mov eax, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1115c0b6
test dx, dx
je 0x1115c0b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1115c0b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1115c090
xor eax, eax
jmp 0x1115c0bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1115c0ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x29e4129f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub cx, word [esi + 0x88]
cmp cx, 0x24
jle 0x1115c11f
xor ecx, ecx
mov word [esi + 0x88], cx
jmp 0x1115c11f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x29e4129f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov word [esi + 0x88], cx
test cx, cx
jne 0x1115c11f
mov edx, 1
mov word [esi + 0x88], dx
cmp word [esi + 0x88], 0
jne 0x1115c134
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1115c134
mov dword [eax], edi
jmp 0x1115c13b
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
push 0
call fcn.11155710
add esp, 4
xor eax, eax
cmp word [esi + 0x88], ax
pop ebx
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenCurrDesktop:_OpenInputDesktop_failed__error__d_n
call fcn.111bd7b0
push 0
call fcn.11155710
add esp, 0xc
jmp 0x1115c1c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push 0x111f9500
push eax
call dword [sym.imp.MSVCR100.dll__swprintf]
push 0
mov dword [esi + 0x30], 1
call fcn.11155710
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push ecx
push str.OpenDesktop
push str.CheckDesktop
push 3
push 0xc0003396
push 1
push edx
call fcn.1115a050
add esp, 0x2c
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret 8