Function at 0x1001bcf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x100535b1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x10065060]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10065060]
xor eax, esp
push eax
lea eax, [esp + 0x2d4]
mov dword fs:[0], eax
test byte [0x10069d8c], 1
mov ebp, dword [esp + 0x2e4]
jne 0x1001bd6f
or dword [0x10069d8c], 1
push 0x10069cec
mov dword [esp + 0x2e0], 0
call fcn.10010d90
push 0x10054320
call fcn.1003a139
add esp, 4
mov dword [esp + 0x2dc], 0xffffffff
lea eax, [esp + 0x14]
push eax
mov eax, ebp
call fcn.1001d840
mov eax, dword [esp + 0x14]
mov esi, dword [0x10069d04]
test eax, eax
je 0x1001bd91
cmp eax, dword [0x10069cec]
je 0x1001bd96
call fcn.1003a2ad
mov ebx, dword [esp + 0x18]
cmp ebx, esi
je 0x1001bdfa
push str.GetTickCount64
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001bdbf
call eax
mov edi, edx
jmp 0x1001bdc7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1001be1b
call fcn.1003a2ad
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x1001bde2
call fcn.1003a2ad
sub esi, dword [ebx + 0x30]
sbb edi, dword [ebx + 0x34]
mov dword [esp + 0x18], edi
jne 0x1001bdfa
cmp esi, 0xbb8
jb 0x1001c13d
push str.GetTickCount64
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001be1f
call eax
mov edi, edx
jmp 0x1001be27
mov eax, dword [eax]
jmp 0x1001bdd8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
push ebp
push 0x10069cec
mov esi, eax
call fcn.10010810
mov dword [eax], esi
push str.AllowUninstallRequest
mov dword [eax + 4], edi
call fcn.10004680
movzx eax, al
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, 0x10059b38
test eax, eax
jne 0x1001be5b
mov ecx, 0x10057ce4
cmp dword [ebp + 0x18], 8
jb 0x1001be66
mov eax, dword [ebp + 4]
jmp 0x1001be69
lea eax, [ebp + 4]
push ecx
push eax
push 0x10059b60
lea esi, [esp + 0xb4]
call fcn.10026d81
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xce]
mov dword [esp + 0x2e4], 1
push edx
mov word [esp + 0xd0], cx
call fcn.1003c500
add esp, 0xc
push 0x104
lea eax, [esp + 0xc8]
push eax
mov ebx, str.wfchost.exe
xor ecx, ecx
call fcn.10025772
and dword [esp + 0x44], 0xfffffe00
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
lea ecx, [esp + 0x20]
push ebp
push ecx
mov byte [esp + 0x2e4], 3
call fcn.10002ed0
mov byte [esp + 0x2e4], 4
sub esp, 0x10
mov esi, esp
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [eax + 0x14]
mov ebp, 0x10
mov dword [esp + 0x2c], esp
cmp dword [eax + 0x18], ebp
jb 0x1001bf23
mov eax, dword [eax + 4]
jmp 0x1001bf26
add eax, 4
push eax
call fcn.1002d140
add esp, 4
mov dword [esi], eax
push str.name
lea edx, [esp + 0x58]
push edx
mov ecx, 0x10058298
mov byte [esp + 0x2fc], 5
call fcn.1002e4e1
mov edi, eax
mov byte [esp + 0x2f4], 4
call fcn.1002d91e
mov byte [esp + 0x2dc], 3
cmp dword [esp + 0x38], ebp
jb 0x1001bf77
mov eax, dword [esp + 0x24]
push eax
call fcn.1003a2e7
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x74]
call fcn.1002eb64
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2e4], 6
call fcn.10034534
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x2ec], 7
call fcn.10002dd0
push eax
push str._uninstRequest
lea edi, [esp + 0xa4]
mov byte [esp + 0x2f4], 8
call fcn.1000c780
add esp, 0x18
mov edi, 8
cmp dword [esp + 0x6c], edi
jb 0x1001bfe0
mov ecx, dword [esp + 0x58]
push ecx
call fcn.1003a2e7
add esp, 4
xor edx, edx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], dx
cmp dword [esp + 0x38], ebp
jb 0x1001c006
mov eax, dword [esp + 0x24]
push eax
call fcn.1003a2e7
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp dword [esp + 0x88], ebp
jb 0x1001c02c
mov ecx, dword [esp + 0x74]
push ecx
call fcn.1003a2e7
add esp, 4
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x1001c063
cmp dword [esp + 0xa4], edi
jb 0x1001c050
mov edi, dword [esp + 0x90]
mov edx, 0x10059bc8
mov ebp, 0x10059bd4
jmp 0x1001c06f
lea edi, [esp + 0x90]
mov edx, 0x10059bc8
mov ebp, 0x10059bd4
jmp 0x1001c06f
xor edi, edi
mov edx, 0x10057d00
mov ebp, 0x10059be4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], ax
mov byte [esp + 0x2dc], 0xd
cmp dword [esp + 0xc0], 8
mov eax, dword [esp + 0xac]
jae 0x1001c0a2
lea eax, [esp + 0xac]
xor ecx, ecx
cmp esi, ebx
sete cl
push ecx
mov ecx, esi
push edx
neg ecx
sbb ecx, ecx
push eax
lea esi, [esp + 0xd0]
and ecx, esi
push ebp
mov edx, edi
call fcn.10003750
mov edi, 8
add esp, 0x10
cmp dword [esp + 0x38], edi
jb 0x1001c0de
mov edx, dword [esp + 0x24]
push edx
call fcn.1003a2e7
add esp, 4
cmp dword [esp + 0xa4], edi
jb 0x1001c0f7
mov eax, dword [esp + 0x90]
push eax
call fcn.1003a2e7
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3c]
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], ebx
mov word [esp + 0x90], cx
mov byte [esp + 0x2dc], 1
call fcn.1002d89b
cmp dword [esp + 0xc0], edi
jb 0x1001c13d
mov edx, dword [esp + 0xac]
push edx
call fcn.1003a2e7
add esp, 4
mov ecx, dword [esp + 0x2d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.10039e38
add esp, 0x2cc
ret