Function at 0x100030148
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push rdi
mov eax, 0x10e0
call fcn.10009eb60
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x10f8], rbx
mov qword [rsp + 0x1100], rbp
mov qword [rsp + 0x1108], rsi
mov rax, qword [0x1000aa140]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
xor ebp, ebp
mov ebx, ebp
mov eax, 0xfdb8
cmp edx, eax
jg 0x10003067b
cmp edx, eax
je 0x100030744
mov eax, 0x9c56
cmp edx, eax
jg 0x10003053b
cmp edx, eax
je 0x1000304e5
mov eax, 0x9c47
cmp edx, eax
jg 0x10003040e
cmp edx, eax
je 0x100030369
sub edx, 0x9c41
je 0x100030261
sub edx, 1
je 0x10003023e
sub edx, 1
je 0x10003021b
sub edx, 1
je 0x100030205
cmp edx, 1
jne 0x1000307c8
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1000307c8
call fcn.10002e160
mov rcx, qword [0x1000b5f78]
call fcn.100037228
jmp 0x1000307c8
cmp byte [0x1000b5ff5], bpl
jne 0x1000307c8
call fcn.10002e72c
mov rcx, qword [0x1000b5f78]
call fcn.100037228
jmp 0x1000307c8
cmp byte [0x1000b5ff5], bpl
jne 0x1000307c8
call fcn.10002d914
mov rcx, qword [0x1000b5f78]
call fcn.100037228
jmp 0x1000307c8
cmp byte [0x1000b6dd0], bpl
jne 0x10003027f
mov byte [0x1000b6dd0], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1000b6dd4], eax
jmp 0x1000302a2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1000b6dd4]
cmp eax, 0x4e2
jb 0x1000307c8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1000b6dd4], eax
mov rbx, qword [0x1000b5f78]
mov rax, qword [rbx + 0xe8]
cmp dword [rax + 0x10], ebp
je 0x10003033b
cmp dword [rbx + 8], 8
je 0x10003033b
call fcn.10002efb8
cmp eax, ebp
jne 0x1000302fd
mov rbx, qword [0x1000b5f78]
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, dword [rbx + 8]
mov dword [rbx + 0xc], r11d
mov dword [rbx + 8], 1
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 8]
jmp 0x1000307c8
cmp eax, 1
jne 0x1000307c8
mov rbx, qword [0x1000b5f78]
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, dword [rbx + 8]
mov dword [rbx + 0xc], r11d
mov dword [rbx + 8], 2
mov rax, qword [rbx]
mov edx, 2
mov rcx, rbx
call qword [rax + 8]
jmp 0x1000307c8
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, dword [rbx + 8]
mov dword [rbx + 0xc], r11d
mov dword [rbx + 8], 1
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 8]
jmp 0x1000307c8
mov edx, 0x6c
mov rcx, qword [0x1000b5ed0]
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, rax
xor edx, edx
lea ecx, [rdx + 3]
call fcn.10003dff0
mov edx, 0x387
lea rcx, [rsp + 0x68]
call fcn.100060490
mov rbx, rax
mov edx, 0x65
lea rcx, [rsp + 0x50]
call fcn.100060490
mov r9, rdi
mov r8, qword [rbx + 0x10]
mov rdx, qword [rax + 0x10]
mov rcx, qword [0x1000b5f98]
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_free
mov rax, qword [0x1000b5f78]
cmp dword [rax + 8], 9
je 0x1000303e9
cmp dword [rax + 8], 0xd
jne 0x100030404
mov rax, qword [rax + 0xe0]
cmp byte [rax + 0x33], bpl
je 0x100030404
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 3]
call fcn.10003dfb4
call fcn.10003c424
jmp 0x1000307c8
sub edx, 0x9c48
je 0x1000304db
sub edx, 3
je 0x1000304ca
sub edx, 1
je 0x1000304af
sub edx, 3
je 0x100030457
cmp edx, 6
jne 0x1000307c8
mov rcx, qword [0x1000b5f78]
call fcn.100037228
mov rcx, qword [0x1000b5f78]
call fcn.100037528
jmp 0x1000307c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x824
lea r8, [rsp + 0x80]
mov edx, 0xa3
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebp
jle 0x1000307c8
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0x80]
lea rdx, [0x100002648]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000307c8
mov r9b, 1
or r8d, 0xffffffff
mov dl, r9b
mov rcx, qword [0x1000b5f78]
call fcn.100034384
jmp 0x1000307c8
mov rcx, qword [0x1000b5f78]
call fcn.1000335e0
jmp 0x1000307c8
call fcn.10003c5c8
jmp 0x1000307c8
mov rcx, qword [0x1000b5f78]
call fcn.100036d84
mov rcx, qword [0x1000b5f78]
call fcn.100036fd4
cmp al, bpl
je 0x1000307c8
mov rbx, qword [0x1000b5f78]
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, dword [rbx + 8]
mov dword [rbx + 0xc], r11d
mov dword [rbx + 8], 1
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 8]
jmp 0x1000307c8
mov eax, 0x9c66
cmp edx, eax
jg 0x100030610
cmp edx, eax
je 0x1000305f6
sub edx, 0x9c58
je 0x1000305e0
sub edx, 8
je 0x1000305cd
sub edx, 2
je 0x1000305ba
sub edx, 2
je 0x1000305a9
cmp edx, 1
jne 0x1000307c8
mov rbx, qword [0x1000b5f78]
mov rax, qword [rbx]
mov edx, dword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, dword [rbx + 8]
mov dword [rbx + 0xc], r11d
mov dword [rbx + 8], 5
mov rax, qword [rbx]
mov edx, 5
mov rcx, rbx
call qword [rax + 8]
jmp 0x1000307c8
mov rcx, qword [0x1000b5f78]
call fcn.100036c7c
jmp 0x1000307c8
mov rax, qword [0x1000b5f78]
mov dword [rax + 0x2c], 0x384
jmp 0x1000307c8
cmp byte [0x1000b5d3b], bpl
sete byte [0x1000b5d3b]
jmp 0x1000307c8
mov edx, 0x1c
mov rcx, qword [0x1000b3838]
call fcn.10003b058
jmp 0x1000307c8
mov rax, qword [0x1000b5f78]
mov byte [rax + 0x11c], 1
mov byte [rax + 0x11d], bpl
jmp 0x1000307c8
sub edx, 0x9c68
je 0x100030661
sub edx, 2
je 0x100030647
sub edx, 5
je 0x100030636
sub edx, 2
je 0x100030632
cmp edx, 1
jne 0x1000307c8
mov ebx, edx
inc ebx
jmp 0x1000306af
mov rcx, qword [0x1000b5f78]
call fcn.100034d8c
jmp 0x1000307c8
mov rax, qword [0x1000b5f78]
mov byte [rax + 0x11c], bpl
mov byte [rax + 0x11d], bpl
jmp 0x1000307c8
mov rax, qword [0x1000b5f78]
mov byte [rax + 0x11c], 1
mov byte [rax + 0x11d], 1
jmp 0x1000307c8
sub edx, 0xfdb9
je 0x100030742
sub edx, 1
je 0x100030740
sub edx, 1
je 0x1000306b3
sub edx, 1
je 0x1000306b1
sub edx, 1
je 0x1000306af
cmp edx, 1
jne 0x1000307c8
mov ebx, edx
jmp 0x100030740
inc ebx
inc ebx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x40], rbp
mov rax, qword [0x1000b5f78]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x40]
call fcn.10006e680
mov r11, qword [0x1000b5f78]
mov edx, ebx
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi + rdx*8]
mov rcx, qword [r11 + 0x40]
call fcn.10006e7d8
mov rcx, qword [0x1000b5f78]
call fcn.100037228
mov r11d, dword [rsp + 0x30]
cmp r11d, ebp
jbe 0x100030729
mov rbx, rdi
mov rsi, r11
mov rcx, qword [rbx]
call sub.msvcrt.dll_free
mov qword [rbx], rbp
add rbx, 8
sub rsi, 1
jne 0x100030714
cmp rdi, rbp
je 0x1000307c8
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1000307c8
inc ebx
inc ebx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x40], rbp
mov rax, qword [0x1000b5f78]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x40]
call fcn.10006e72c
mov r11, qword [0x1000b5f78]
mov edx, ebx
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rdi + rdx*8]
mov rcx, qword [r11 + 0x40]
call fcn.10006ece4
mov rcx, qword [0x1000b5f78]
call fcn.100037228
mov r11d, dword [rsp + 0x30]
cmp r11d, ebp
jbe 0x1000307ba
mov rbx, rdi
mov rsi, r11
mov rcx, qword [rbx]
call sub.msvcrt.dll_free
mov qword [rbx], rbp
add rbx, 8
sub rsi, 1
jne 0x1000307a5
cmp rdi, rbp
je 0x1000307c8
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.10009dad0
lea r11, [rsp + 0x10e0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret