Function at 0x11e0ec90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x11fb9f6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x244
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
xor edi, edi
mov ecx, 0x1212e6c0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], 1
call fcn.11e07910
mov ebp, eax
cmp ebp, edi
je 0x11e0efec
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x20]
call fcn.11e08b40
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], edi
call fcn.11e08be0
test eax, eax
je 0x11e0f045
call ebx
mov edi, dword [ebp + 0x830]
or esi, 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x25c], esi
call fcn.11e08b90
test edi, edi
jne 0x11e0ef82
mov ecx, 0x1212b458
call fcn.11df57f0
test eax, eax
jne 0x11e0ed6f
mov ecx, 0x1212b458
call fcn.11df41e0
test eax, eax
je 0x11e0ef82
call ebx
mov dword [esp + 0x28], eax
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.11e93550
test eax, eax
je 0x11e0eda6
mov ecx, 0x1212b458
call fcn.11ec4670
test eax, eax
je 0x11e0efea
mov eax, dword [0x12134be4]
test eax, eax
je 0x11e0efea
mov eax, dword [0x1212c7e0]
test eax, eax
jne 0x11e0edce
mov ecx, 0x1212b458
call fcn.11df5100
test eax, eax
jne 0x11e0efea
call ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], eax
call fcn.11e13d90
mov ecx, 0x1212b458
mov dword [esp + 0x25c], 1
call fcn.11df5280
test eax, eax
je 0x11e0ee20
mov eax, dword [0x12133f80]
test eax, eax
je 0x11e0ee13
push str._CSDConfig::SetPassthroughLogDoc__start_Impersonated_
push str.ExpandPath
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.11e13e10
test eax, eax
je 0x11e0ee72
call ebx
mov dword [esp + 0x2c], eax
push 0
lea eax, [esp + 0x50]
push 0x23
push eax
push 0
call dword [0x12134be4]
mov edi, eax
call ebx
mov dword [esp + 0x48], eax
mov eax, dword [0x12133f80]
test eax, eax
je 0x11e0ee67
mov eax, dword [0x12126854]
lea ecx, [esp + 0x4c]
push ecx
push eax
push str.__s__CTSafeDocShareDataMgr::GetCommonAppDataPath_Path__s__r_n
push str.ExpandPath
push 1
call fcn.11ca5810
add esp, 0x14
test edi, edi
jne 0x11e0ee91
mov esi, 1
jmp 0x11e0ee91
mov eax, dword [0x12133f80]
test eax, eax
je 0x11e0ee8f
push str._CSDConfig::SetPassthroughLogDoc__Impersonate_failed_
push str.ExpandPath
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], 0xffffffff
call fcn.11e13dd0
call ebx
test esi, esi
mov dword [esp + 0x10], eax
jne 0x11e0f08b
lea edx, [esp + 0x4c]
push edx
call fcn.11e67d05
add esp, 4
test eax, eax
je 0x11e0f08b
mov eax, dword [0x1212e6d4]
test eax, eax
jne 0x11e0f05b
mov ecx, 0x1212b458
call fcn.11df5100
test eax, eax
jne 0x11e0eeec
call fcn.11e13cf0
test eax, eax
je 0x11e0ef1b
mov ecx, 0x1212b458
call fcn.11df5280
test eax, eax
jne 0x11e0ef1b
lea eax, [esp + 0x4c]
push 0x104
push eax
push 0x1212f74c
call fcn.11e674bf
add esp, 0xc
mov dword [esp + 0x44], 0
jmp 0x11e0ef79
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x20]
call fcn.11e08b40
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], 2
call fcn.11e08be0
test eax, eax
je 0x11e0f077
lea edi, [ebp + 0x834]
mov ecx, 0x82
lea esi, [esp + 0x4c]
mov dword [ebp + 0x830], 1
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], 0xffffffff
call fcn.11e08b90
call ebx
mov dword [esp + 0x14], eax
or esi, 0xffffffff
call ebx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
test eax, eax
je 0x11e0efea
push 0x1388
push 0x1212e4e0
lea ecx, [esp + 0x20]
call fcn.11e08b40
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], 3
call fcn.11e08be0
test eax, eax
je 0x11e0efda
call ebx
add ebp, 0x834
push 0x104
push ebp
push 0x1212f74c
mov dword [esp + 0x4c], eax
call fcn.11e674bf
add esp, 0xc
mov dword [esp + 0x25c], esi
lea ecx, [esp + 0x18]
call fcn.11e08b90
xor edi, edi
push 0x1212f74c
call fcn.11e67d05
add esp, 4
test eax, eax
jne 0x11e0f019
push str.GetCommonAppDataPath
push str._c:ProgramData
push str._c:Documents_and_SettingsAll_UsersApplication_Data
push 0x1212f74c
call fcn.11e13120
add esp, 0x10
call ebx
cmp eax, dword [esp + 0x3c]
jbe 0x11e0f176
cmp dword [0x12133f80], edi
je 0x11e0f176
mov esi, dword [esp + 0x40]
cmp esi, edi
je 0x11e0f0b8
mov ecx, dword [esp + 0x38]
cmp ecx, edi
je 0x11e0f0b8
sub esi, ecx
jmp 0x11e0f0ba
lea ecx, [esp + 0x18]
mov dword [esp + 0x25c], 0xffffffff
call fcn.11e08b90
jmp 0x11e0efec
lea ecx, [esp + 0x4c]
push 0x104
push ecx
push 0x1212f74c
call fcn.11e674bf
add esp, 0xc
jmp 0x11e0efea
mov dword [esp + 0x25c], 0xffffffff
lea ecx, [esp + 0x18]
jmp 0x11e0efe5
mov eax, dword [0x12133f80]
test eax, eax
je 0x11e0efea
mov edx, dword [0x12126854]
push edx
push str.__s__CTSafeDocShareDataMgr::GetCommonAppDataPath_coercion__r_n
push str.ExpandPath
push 1
call fcn.11ca5810
add esp, 0x10
jmp 0x11e0efea
xor esi, esi
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x11e0f0d2
mov edx, dword [esp + 0x14]
cmp edx, edi
je 0x11e0f0d2
sub edx, ecx
mov dword [esp + 0x14], edx
jmp 0x11e0f0d6
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x28]
cmp edx, edi
je 0x11e0f0ea
cmp ecx, edi
je 0x11e0f0ea
sub ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x11e0f0ee
mov dword [esp + 0x10], edi
mov ebx, dword [esp + 0x2c]
cmp ebx, edi
je 0x11e0f102
mov ebp, dword [esp + 0x48]
cmp ebp, edi
je 0x11e0f102
sub ebp, ebx
jmp 0x11e0f104
xor ebp, ebp
mov ecx, dword [esp + 0x30]
cmp ecx, edi
je 0x11e0f114
cmp ebx, edi
je 0x11e0f114
sub ebx, ecx
jmp 0x11e0f116
xor ebx, ebx
cmp edx, edi
je 0x11e0f122
cmp ecx, edi
je 0x11e0f122
sub ecx, edx
mov edi, ecx
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x11e0f136
mov edx, dword [esp + 0x28]
test edx, edx
je 0x11e0f136
sub edx, ecx
jmp 0x11e0f138
xor edx, edx
test eax, eax
je 0x11e0f144
test ecx, ecx
je 0x11e0f144
sub ecx, eax
jmp 0x11e0f146
xor ecx, ecx
push 0x1212f74c
push esi
mov esi, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x54]
push edi
push edx
sub eax, ebx
push ecx
push eax
push str.GetCommonAppDataPath_t2_t1__lu__t3_t2__lu__t4_t3__lu__t5_t4__lu__t6_t5__lu__t7_t6__lu__t8_t4__lu__t9_t8__lu__t11_t10__lu__ret__s_
push str.ExpandPath
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x34
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
mov eax, 0x1212f74c
pop ebx
mov dword fs:[0], ecx
add esp, 0x250
ret