Function at 0x102b00f
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1086e97
mov eax, dword fs:[0]
push eax
mov eax, 0x1078
call fcn.01034d30
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0xffff63bf
xor ebx, ebx
xor esi, esi
cmp eax, 0x28
ja case.0x102b05b.40006
xor ecx, ecx
inc ecx
jmp dword [eax*4 + 0x102b457]
call fcn.010366d2
jmp case.0x102b05b.40006
push 0x6c
push dword [0x1096bdc]
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
mov eax, dword [0x1097074]
mov eax, dword [eax + 4]
cmp eax, 6
jne 0x102b091
push ebx
push 3
call fcn.01035401
push 0x387
lea ecx, [ebp - 0x1078]
call fcn.010557e2
mov esi, eax
push 0x65
lea ecx, [ebp - 0x1084]
mov dword [ebp - 4], ebx
call fcn.010557e2
mov esi, dword [esi + 8]
mov eax, dword [eax + 8]
push edi
push esi
push eax
push dword [0x1097430]
call dword [sym.imp.SHELL32.dll_ShellAboutW]
lea ecx, [ebp - 0x1084]
call fcn.010558b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1078]
call fcn.010558b4
mov ecx, dword [0x1097074]
cmp dword [ecx + 4], 6
jne 0x102b101
call fcn.0102cbb7
test al, al
je 0x102b101
push ebx
push 1
push 3
call fcn.010353c6
call fcn.01035b98
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.0103328b
jmp case.0x102b05b.40006
cmp byte [0x1097014], bl
jne 0x102b132
mov byte [0x1097014], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x102b14d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1097010]
cmp eax, 0x4e2
jb case.0x102b05b.40006
call esi
mov ecx, dword [0x1097074]
mov dword [0x1097010], eax
call fcn.0102e155
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.01031acc
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.01031e2d
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.01032b79
jmp case.0x102b05b.40006
call fcn.01035b0e
test al, al
jne case.0x102b05b.40006
call fcn.01029165
jmp case.0x102b05b.40006
call fcn.01029f32
jmp case.0x102b05b.40006
call fcn.01035b0e
test al, al
jne case.0x102b05b.40006
call fcn.0102a6e0
jmp case.0x102b05b.40006
push ebx
push ebx
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x102b05b.40006
push 0x824
lea eax, [ebp - 0x1058]
push eax
push 0x7535
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle case.0x102b05b.40006
push 1
push ebx
push ebx
lea eax, [ebp - 0x1058]
push eax
push 0x1001fc4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.0103128b
mov ecx, dword [0x1097074]
call fcn.0102cf8d
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.010310d8
mov ecx, dword [0x1097074]
push ebx
call fcn.010324ac
jmp case.0x102b05b.40006
push 1
mov ecx, dword [0x1097074]
call fcn.0102cc3a
mov ecx, dword [0x1097074]
call fcn.0102e155
mov ecx, dword [0x1097074]
call fcn.0102dfe9
jmp case.0x102b05b.40006
push ebx
jmp 0x102b256
mov ecx, dword [0x1097074]
call fcn.0102e5c1
mov ecx, dword [0x1097074]
push eax
call fcn.010298b7
jmp case.0x102b05b.40006
mov ecx, dword [0x1097074]
call fcn.0102cd22
jmp case.0x102b05b.40006
mov eax, dword [0x1097074]
mov byte [eax + 0xbd], bl
jmp case.0x102b05b.40006
mov eax, dword [0x1097074]
mov byte [eax + 0xbd], 1
jmp case.0x102b05b.40006
mov esi, ecx
inc esi
inc esi
mov dword [ebp - 0x1068], ebx
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], 0x10
mov dword [ebp - 0x105c], ebx
lea eax, [ebp - 0x1068]
mov dword [ebp - 4], ecx
mov ecx, dword [0x1097074]
push eax
call fcn.0102cb27
mov ecx, eax
call fcn.0105dcbe
mov eax, dword [ebp - 0x105c]
mov ecx, dword [0x1097074]
shl esi, 2
add eax, esi
push dword [eax]
call fcn.0102cb27
mov ecx, eax
call fcn.0105e153
mov eax, dword [ebp - 0x105c]
push dword [esi + eax]
mov ecx, dword [0x1097074]
call fcn.0102ccca
mov ecx, dword [0x1097074]
call fcn.0103128b
xor esi, esi
cmp dword [ebp - 0x1068], ebx
jbe 0x102b42e
mov eax, dword [ebp - 0x105c]
push dword [eax + esi*4]
call fcn.0103479e
mov eax, dword [ebp - 0x105c]
mov dword [eax + esi*4], ebx
inc esi
pop ecx
cmp esi, dword [ebp - 0x1068]
jb 0x102b354
jmp 0x102b42e
xor esi, esi
inc esi
inc esi
inc esi
inc esi
mov dword [ebp - 0x1068], ebx
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], 0x10
mov dword [ebp - 0x105c], ebx
mov ecx, dword [0x1097074]
lea eax, [ebp - 0x1068]
push eax
mov dword [ebp - 4], 2
call fcn.0102cb27
mov ecx, eax
call fcn.0105dbf6
mov eax, dword [ebp - 0x105c]
sub esp, 0xc
shl esi, 2
add eax, esi
mov ecx, esp
mov dword [ebp - 0x106c], esp
push dword [eax]
call fcn.01055719
mov ecx, dword [0x1097074]
call fcn.0102f1af
mov eax, dword [ebp - 0x105c]
push dword [esi + eax]
mov ecx, dword [0x1097074]
call fcn.0102cce0
mov ecx, dword [0x1097074]
call fcn.0103128b
xor esi, esi
cmp dword [ebp - 0x1068], ebx
jbe 0x102b42e
mov eax, dword [ebp - 0x105c]
push dword [eax + esi*4]
call fcn.0103479e
mov eax, dword [ebp - 0x105c]
mov dword [eax + esi*4], ebx
inc esi
pop ecx
cmp esi, dword [ebp - 0x1068]
jb 0x102b40d
lea ecx, [ebp - 0x1068]
call fcn.0102d91f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01034b69
leave
ret 4