Function at 0x1000a220
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [0x10024038]
lea ecx, [esp + 0x3c]
mov dword [ecx + 8], eax
movsd xmm0, qword [0x10024030]
movsd qword [ecx], xmm0
xor eax, eax
lea edx, [esp + 0x24]
mov dword [edx], eax
lea esi, [esp + 0x10]
mov dword [esi], eax
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ecx, dword [0x1002d188]
mov edx, dword [0x1002d18c]
cmp edx, 0xa
jl 0x1000a2c8
mov dword [esp + 4], 0
lea esi, [ecx + 1]
imul esi, ecx
and esi, 1
je 0x1000a2d0
xor esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [esp + 0x10], esi
push esi
lea edi, [esp + 0x40]
push edi
lea eax, [esp + 0x18]
push eax
lea ebx, [esp + 0x30]
push ebx
call ebp
mov dword [esp + 0x10], esi
push esi
push edi
lea eax, [esp + 0x18]
push eax
push ebx
call ebp
mov ecx, dword [0x1002d188]
mov edx, dword [0x1002d18c]
cmp edx, 0xa
jl 0x1000a2d0
lea edi, [ecx + 1]
imul edi, ecx
and edi, 1
jne 0x1000a286
jmp 0x1000a2d0
mov dword [esp + 4], 0
mov esi, dword [esp + 0xa8]
test eax, eax
je 0x1000a2ed
cmp edx, 0xa
jl 0x1000a2f4
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
jne 0x1000a32a
jmp 0x1000a2f4
xor edi, edi
jmp 0x1000abbc
mov esi, 0x44
lea edi, [esp + 0x48]
push esi
push edi
call sub.NTDLL.dll_RtlZeroMemory
mov dword [edi], esi
mov dword [edi + 0x2c], 0x101
mov edx, dword [esp + 0x10]
cmp dword [0x1002d18c], 0xa
jl 0x1000a345
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000a345
mov esi, 0x44
lea edi, [esp + 0x48]
push esi
push edi
call sub.NTDLL.dll_RtlZeroMemory
mov dword [edi], esi
mov dword [edi + 0x2c], 0x101
jmp 0x1000a2f4
lea ebp, [esp + 0x2c]
xor ebx, ebx
mov eax, edx
mov dword [esp + 0xc], edx
mov esi, edx
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], eax
push 0x10
push ebp
call sub.NTDLL.dll_RtlZeroMemory
sub esp, 0x28
mov edi, ebp
mov dword [esp + 0x24], ebp
lea ebp, [esp + 0x70]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x100242e0]
movups xmmword [esp + 8], xmm0
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
call ebx
cmp dword [0x1002d18c], 0xa
jl 0x1000a41a
mov edx, dword [0x1002d188]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
je 0x1000a41a
mov dword [esp + 0x88], esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x84], eax
push 0x10
push edi
call sub.NTDLL.dll_RtlZeroMemory
sub esp, 0x28
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebp
mov eax, ebx
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x100242e0]
movups xmmword [esp + 8], xmm0
mov esi, dword [esp + 0xc8]
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
mov edx, dword [esp + 0xc]
mov ebp, edi
mov eax, dword [esp + 0x10]
jmp 0x1000a351
mov esi, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d18c], 0xa
jl 0x1000a46a
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000a46a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x10]
call edi
push dword [esp + 0x10]
call edi
cmp dword [0x1002d18c], 0xa
jl 0x1000a46a
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000a445
test esi, esi
je 0x1000a4d8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x401
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1000a4ee
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1002d18c], 0xa
mov dword [esp], esi
jl 0x1000a50b
mov ecx, dword [0x1002d188]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
mov edi, dword [esp + 0xa4]
je 0x1000a512
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
cmp dword [0x1002d18c], 0xa
jl 0x1000a512
mov ecx, dword [0x1002d188]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000a4b8
jmp 0x1000a512
xor edi, edi
mov dword [esp + 4], 0
mov esi, dword [esp + 0xa8]
jmp 0x1000abb2
mov edx, dword [0x1002d188]
mov eax, dword [0x1002d18c]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
xor edi, edi
xor edx, edx
jmp 0x1000ab5b
mov edi, dword [esp + 0xa4]
imul ecx, edi, 0x3e8
add ecx, eax
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x14]
mov dword [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [esp + 4], 0
mov ebp, dword [esp]
push 0
lea eax, [esp + 0x18]
push eax
push 0x400
push ebp
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000ab33
cmp dword [esp + 0x14], 0
je 0x1000ab33
mov eax, dword [esp + 0x14]
mov byte [ebp + eax], 0
cmp dword [0x1002d18c], 0xa
jl 0x1000a5b4
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000a5b4
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [ebp + eax], cl
mov eax, dword [esp + 0x14]
mov byte [ebp + eax], cl
cmp dword [0x1002d18c], 0xa
jl 0x1000a565
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000a587
jmp 0x1000a565
xor eax, eax
push eax
push eax
push dword [esp + 0x1c]
push ebp
push eax
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1000a78a
mov dword [esp + 8], edi
mov dword [esp + 0x18], eax
lea ebp, [eax + eax]
add ebp, 2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [0x1002d18c], 0xa
jl 0x1000a628
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000a628
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
push ebp
mov edi, 8
push edi
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call ebx
call esi
push ebp
push edi
push eax
call ebx
jmp 0x1000a5ec
test esi, esi
je 0x1000a883
mov eax, dword [esp + 0x14]
push dword [esp + 0x18]
push esi
mov dword [esp + 0x24], eax
push eax
push dword [esp + 0xc]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
cmp ecx, 0xa
mov dword [esp + 0xc], esi
jl 0x1000a6ba
lea edi, [edx + 1]
imul edi, edx
and edi, 1
je 0x1000a6ba
mov edi, dword [esp + 0x18]
push edi
push esi
mov ebp, dword [esp + 0x24]
push ebp
mov ebx, dword [esp + 0xc]
push ebx
xor eax, eax
push eax
xor eax, eax
inc eax
push eax
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call esi
push edi
push dword [esp + 0x10]
push ebp
push ebx
xor ebx, ebx
inc ebx
xor eax, eax
push eax
push ebx
call esi
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
cmp ecx, 0xa
jl 0x1000a6ba
lea edi, [edx + 1]
imul edi, edx
and edi, ebx
mov esi, dword [esp + 0xc]
jne 0x1000a66c
test eax, eax
je 0x1000a895
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000a792
test eax, eax
je 0x1000a792
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov esi, dword [esp + 0x38]
mov dword [esp + 0xc], esi
mov ebp, dword [esp + 0x2c]
mov dword [esp + 8], ebp
xor eax, eax
mov dword [esp + 4], eax
mov ebx, 0xfde9
mov dword [esp], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call edi
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebp
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
mov ecx, dword [0x1002d188]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1002d18c], 0xa
jl 0x1000a6c2
test eax, eax
jne 0x1000a716
jmp 0x1000a6c2
mov ebp, dword [esp]
jmp 0x1000aaaf
test esi, esi
je 0x1000a89e
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [esp + 4]
lea ebx, [eax + esi]
inc ebx
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x1c], esi
je 0x1000a821
mov dword [esp + 0x20], ebx
push ebx
push eax
push 0
push edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
call ebx
mov ebp, eax
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
cmp ecx, 0xa
jl 0x1000a8b2
lea eax, [edx + 1]
imul eax, edx
and eax, 1
je 0x1000a8b2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
mov ebp, dword [esp + 0x20]
push ebp
mov edi, dword [esp + 0xc]
push edi
xor ecx, ecx
push ecx
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapReAlloc]
call ebx
call esi
push ebp
push edi
xor ecx, ecx
push ecx
push eax
jmp 0x1000a7c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
call esi
mov edx, eax
cmp dword [0x1002d18c], 0xa
jl 0x1000a83a
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000a815
push ebx
push 8
mov dword [esp + 0x10], edx
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000a8c3
test eax, eax
je 0x1000a8c3
push ebx
mov edi, 8
push edi
mov ebp, dword [esp + 0x10]
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call esi
push ebx
push edi
push ebp
call esi
jmp 0x1000a848
mov edi, dword [esp + 8]
mov ebp, dword [esp]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1000aaaf
lea eax, [edx + 1]
imul eax, edx
and eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [esp]
jmp 0x1000a9bc
test ebp, ebp
je 0x1000a9cb
lea eax, [edx + 1]
imul eax, edx
and eax, 1
mov edx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
add esi, edx
test ebp, ebp
je 0x1000a9a1
mov dword [esp + 0x20], esi
mov dword [esp + 8], ebp
add edx, ebp
mov dword [esp + 4], edx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
push dword [esp + 0x24]
push dword [esp + 0x10]
push dword [esp + 0x28]
push dword [esp + 0x20]
push eax
push 0xfde9
call esi
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000a988
test eax, eax
je 0x1000a988
xor eax, eax
push eax
push eax
xor eax, eax
mov edi, dword [esp + 0x24]
push edi
mov esi, dword [esp + 0x10]
push esi
mov ebx, dword [esp + 0x28]
push ebx
mov ebp, dword [esp + 0x20]
push ebp
push eax
mov eax, 0xfde9
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
xor eax, eax
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebp
push eax
mov eax, 0xfde9
push eax
call esi
mov ecx, dword [0x1002d188]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1002d18c], 0xa
jl 0x1000a8e9
test eax, eax
jne 0x1000a923
jmp 0x1000a8e9
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
mov ebp, dword [esp]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000a9bc
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [esp]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ecx, 0xa
jl 0x1000aa3a
test eax, eax
jne 0x1000aa5b
jmp 0x1000aa3a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [esp + 8]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
xor ebp, ebp
cmp ecx, 0xa
jl 0x1000a8c3
test eax, eax
je 0x1000a8c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call esi
xor ebp, ebp
push ebx
push ebp
push eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
call edi
call esi
push ebx
push ebp
push eax
call edi
mov edx, dword [0x1002d188]
mov ecx, dword [0x1002d18c]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
jmp 0x1000a9f6
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp dword [0x1002d18c], 0xa
jl 0x1000aa63
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000aa63
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1000aa3a
push dword [esp + 0xc]
push 0
push edi
call esi
cmp dword [0x1002d18c], 0xa
jl 0x1000aaa7
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000aa9e
mov ebx, dword [esp + 0xc]
push ebx
xor ebp, ebp
push ebp
push edi
call esi
push ebx
push ebp
push edi
call esi
cmp dword [0x1002d18c], 0xa
jge 0x1000aa75
mov ebp, dword [esp]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 8]
jmp 0x1000aaaf
call ebx
call ebx
cmp dword [0x1002d18c], 0xa
jl 0x1000aacb
mov ecx, dword [0x1002d188]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000aaad
cmp eax, dword [esp + 0x28]
jae 0x1000aad9
test edi, edi
jne 0x1000a53b
mov esi, dword [esp + 0x2c]
push 0
push esi
call sub.NTDLL.dll_NtTerminateProcess
cmp dword [0x1002d18c], 0xa
jl 0x1000ab30
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ab30
mov ebx, edi
xor edi, edi
push edi
push esi
call sub.NTDLL.dll_NtTerminateProcess
push edi
push esi
call sub.NTDLL.dll_NtTerminateProcess
cmp dword [0x1002d18c], 0xa
jl 0x1000ab29
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ab02
mov ebp, dword [esp]
mov edi, ebx
jmp 0x1000ab33
mov ebp, dword [esp]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d188]
mov eax, dword [0x1002d18c]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
mov edx, dword [esp + 4]
mov ebx, edi
mov dword [esp + 4], edx
test ecx, ecx
sete cl
cmp eax, 0xa
setl al
or al, cl
test al, al
je 0x1000ab6e
mov esi, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push dword [esp + 0x2c]
call edi
cmp dword [0x1002d18c], 0xa
jl 0x1000aba9
mov eax, dword [0x1002d188]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000aba9
push esi
call edi
push dword [esp + 0x2c]
call edi
jmp 0x1000ab7c
mov esi, dword [esp + 0xa8]
mov edi, ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, edi
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret