Function at 0x4014b0
Capabilities:
Check for time delay via gettickcount
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x577f00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0xffffffffffffffeb
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call ebx
push 0xffffffffffffffeb
call esi
push eax
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
push str.kHP1
push 0
call ebx
push 1
push 0x3ce
push 0x190
push 0x3df
push 0x3db
call esi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push str.._Fy9U
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0xfffffffffffffff0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0xcf0000
push str.axvPU
push str.qX3oK
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push str.Yvsyk
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffffe
cmp ebx, 1
jb 0x4015c8
mov cl, 0xd9
jmp 0x4015b0
mov eax, dword [ebp - 0x130]
cmp byte [eax + ebx], 0xff
jne 0x4015c2
cmp byte [eax + ebx + 1], cl
je 0x4015da
dec ebx
cmp ebx, 1
jae 0x4015b0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005090f0
mov esp, ebp
pop ebp
ret
push 0xfffffffffffffff0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 1
push str.._6yVJU
push str.._Wkg1
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.KjY1E
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 4
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
push str.._sTx40
sub ebx, edi
push str.._MLa0
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00403392
add esp, 4
push 0
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x130]
add ecx, dword [ebp - 0x12c]
push edi
push ecx
push ebx
call fcn.0050d6e0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x100
lea eax, [ebp - 0x114]
push eax
push 0
push 0x2cc
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp + 0x10]
push edi
call fcn.004013b0
add esp, 4
push str.._nX9K8
push str.._sdj2c
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.._Pbne0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.67kb
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x134]
push 0
mov dword [ecx], edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea edx, [ebp - 0x114]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x128]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [ebp - 8]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005090f0
mov esp, ebp
pop ebp
ret