Function at 0x436300
Capabilities:
Check for time delay via gettickcount
Check if file exists
Delete file
Move file

Disassembly:
push 0xd10
mov eax, 0x448345
call fcn.00445ec9
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc7c], eax
push 0x44d74c
lea eax, [ebp - 0xc70]
mov ebx, ecx
mov edi, edx
xor esi, esi
push eax
mov dword [ebp - 0xc74], ebx
mov dword [ebp - 0xc84], edi
mov dword [ebp - 0xc58], esi
call fcn.004370a1
lea ecx, [ebp - 0xc70]
lea eax, [ebx + 0x48]
push ecx
push eax
mov dword [ebp - 0xc64], eax
lea eax, [ebp - 0xc68]
push eax
mov dword [ebp - 4], esi
call fcn.00422610
add esp, 0xc
lea ecx, [ebp - 0xc70]
mov byte [ebp - 4], 2
call fcn.0040fa10
push str._kti
lea eax, [ebp - 0xc50]
push eax
call fcn.004370a1
lea eax, [ebp - 0xc50]
push eax
push dword [ebp - 0xc64]
lea eax, [ebp - 0xc78]
push eax
mov byte [ebp - 4], 3
call fcn.00422610
add esp, 0xc
lea ecx, [ebp - 0xc50]
mov byte [ebp - 4], 5
call fcn.0040fa10
lea ecx, [ebp - 0xc78]
call fcn.00433de0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436403
lea ecx, [ebp - 0xc68]
call fcn.00433de0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x436403
lea ecx, [ebp - 0xc68]
call fcn.00433de0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc78]
call fcn.00433de0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0xf4], esi
je 0x436412
mov eax, 0x44b954
jmp 0x43641d
mov ecx, dword [ebp - 0xc64]
call fcn.00433de0
push eax
lea ecx, [ebp - 0xcec]
call fcn.0040f5f0
mov dword [ebp - 0xcc0], esi
mov dword [ebp - 0xcbc], esi
mov dword [ebp - 0xcb8], esi
mov dword [ebp - 0xcb0], esi
mov dword [ebp - 0xcac], esi
mov dword [ebp - 0xca8], esi
mov dword [ebp - 0xca0], esi
mov dword [ebp - 0xc9c], esi
mov dword [ebp - 0xc98], esi
mov dword [ebp - 0xc90], esi
mov dword [ebp - 0xc8c], esi
mov dword [ebp - 0xc88], esi
mov dword [ebp - 0xccc], esi
mov dword [ebp - 0xcc8], esi
lea ecx, [ebp - 0xd1c]
mov byte [ebp - 4], 0xa
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x1c]
push 6
lea edx, [ebx + 0x70]
pop ecx
push dword [ebx + 4]
mov esi, eax
mov edi, edx
lea ebx, [ebp - 0xcec]
rep movsd dword es:[edi], dword [esi]
call fcn.00437605
mov edi, dword [ebp - 0xc74]
lea ebx, [edi + 8]
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], edx
inc dword [ebx + 0x38]
mov ecx, ebx
mov dword [ebp - 0xc80], ebx
call fcn.00433de0
push dword [edi + 0x7c]
mov ecx, dword [ebp - 0xc64]
push dword [edi + 0x78]
push dword [edi + 0x84]
push dword [edi + 0x80]
push dword [ecx]
push eax
call fcn.00438ca7
mov eax, dword [edi + 0x80]
add esp, 0x18
or eax, dword [edi + 0x84]
jne 0x436537
lea ecx, [ebp - 0xc68]
call fcn.00433de0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436537
lea ecx, [ebp - 0xc68]
call fcn.00433de0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
lea ecx, [ebp - 0xc78]
call fcn.00433de0
push eax
call esi
lea ecx, [ebp - 0xc68]
call fcn.00433de0
push eax
lea esi, [ebp - 0xd04]
call fcn.00437de1
mov byte [ebp - 4], 0xb
cmp dword [edi + 0xf4], 0
je 0x436565
mov dword [ebp - 0xd00], 1
lea esi, [ebp - 0xd04]
call fcn.00437e10
test eax, eax
jne 0x43659a
mov eax, dword [ebp - 0xc64]
push dword [eax]
call fcn.00438ca7
add esp, 4
mov dword [edi + 0x68], 3
mov dword [ebp - 0xc58], 0xb
jmp 0x436c6f
mov ecx, dword [edi + 0x7c]
test ecx, ecx
mov eax, dword [edi + 0x78]
jl 0x4365b7
jg 0x4365aa
test eax, eax
jbe 0x4365b7
push ecx
push eax
lea esi, [ebp - 0xd04]
call fcn.00437e4f
and dword [ebp - 0xc5c], 0
cmp dword [edi + 4], 0
mov dword [ebp - 0xc60], 1
jle 0x436969
jmp 0x4365da
mov ebx, dword [ebp - 0xc80]
cmp dword [ebp - 0xc60], 0
je 0x43665a
push 0
lea ebx, [ebp - 0xcec]
call fcn.00437857
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x43695d
mov eax, dword [esi + 0x1c]
cmp eax, ebx
mov ecx, dword [ebp - 0xc84]
mov edx, dword [esi + 0x18]
mov dword [esi + 0x20], ecx
jl 0x436626
jg 0x436615
cmp edx, ebx
jbe 0x436626
push dword [esi + 0x14]
mov edx, dword [ecx]
push dword [esi + 0x10]
push eax
push dword [esi + 0x18]
call dword [edx + 0x2c]
jmp 0x436641
mov eax, dword [esi + 0x14]
cmp eax, ebx
mov edx, dword [esi + 0x10]
jl 0x436641
jg 0x436636
cmp edx, ebx
jbe 0x436641
mov edx, dword [ecx]
push eax
push dword [esi + 0x10]
push ebx
push ebx
call dword [edx + 0x30]
push dword [edi + 0x7c]
mov ecx, dword [esi + 0x20]
push dword [edi + 0x78]
mov eax, dword [ecx]
call dword [eax + 0x38]
mov dword [ebp - 0xc60], ebx
jmp 0x4366e5
lea ecx, [ebp - 0xc50]
call fcn.0040fa30
push ebx
lea ecx, [ebp - 0xc50]
mov byte [ebp - 4], 0xc
call fcn.00414130
inc dword [ebx + 0x38]
lea ecx, [ebp - 0xc50]
call fcn.00433de0
push eax
lea esi, [ebp - 0xc4c]
call fcn.00438bd3
pop ecx
push 0
lea ebx, [ebp - 0xcec]
call fcn.00437857
mov esi, eax
test esi, esi
je 0x43694c
mov ecx, dword [ebp - 0xc7c]
call fcn.004387cf
push dword [edi + 0x7c]
mov ebx, eax
push dword [edi + 0x78]
mov eax, dword [ebx]
push dword [esi + 0x14]
lea ecx, [ebp - 0xc4c]
push dword [esi + 0x10]
push dword [esi + 0x1c]
push dword [esi + 0x18]
push ecx
mov ecx, ebx
call dword [eax]
lea ecx, [ebp - 0xc50]
mov dword [esi + 0x20], ebx
mov byte [ebp - 4], 0xb
call fcn.0040fa10
lea edi, [ebp - 0xc54]
lea eax, [ebp - 0xcb4]
mov dword [ebp - 0xc54], esi
call fcn.00437c05
inc dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xc5c]
cmp ecx, dword [eax + 4]
mov edi, eax
jl 0x4365d4
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x8c], 1
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
call esi
mov dword [edi + 0xc8], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xb4], eax
mov dword [edi + 0xb0], eax
mov dword [edi + 0xa8], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
call esi
mov ecx, dword [edi + 0x80]
mov dword [edi + 0x60], ecx
mov ecx, dword [edi + 0x84]
mov dword [edi + 0xd0], eax
mov dword [ebp - 0xc84], eax
mov eax, dword [edi + 4]
mov dword [edi + 0x64], ecx
xor ecx, ecx
push 4
inc eax
pop edx
mul edx
seto cl
mov dword [ebp - 0xc5c], ebx
neg ecx
or ecx, eax
push ecx
call fcn.0043a3f2
pop ecx
mov dword [ebp - 0xc50], eax
lea eax, [ebp - 0xcb4]
call fcn.004371a0
test eax, eax
jne 0x4367d0
lea eax, [ebp - 0xca4]
call fcn.004371a0
test eax, eax
je 0x436b4d
mov eax, dword [edi + 4]
mov esi, dword [ebp - 0xc50]
lea eax, [eax*4 + 4]
push eax
push ebx
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [edi + 0x54]
mov dword [esi], eax
add esp, 0xc
lea eax, [ebp - 0xcb4]
xor esi, esi
call fcn.004371a0
test eax, eax
jbe 0x436838
mov ebx, dword [ebp - 0xc50]
add ebx, 4
lea edi, [ebp - 0xcb4]
call fcn.0043716d
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [ebx], eax
mov eax, edi
inc esi
add ebx, 4
call fcn.004371a0
cmp esi, eax
jb 0x43680a
mov edi, dword [ebp - 0xc74]
xor ebx, ebx
mov eax, edi
call fcn.00435eab
test eax, eax
jne 0x436b18
cmp dword [edi + 0xf0], ebx
jne 0x436b18
mov esi, 0x3e8
push esi
push ebx
push dword [ebp - 0xc50]
lea eax, [ebp - 0xcb4]
call fcn.004371a0
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0xc6c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc60], eax
sub eax, dword [edi + 0xb8]
cmp eax, esi
jbe 0x4368f1
push dword [edi + 0xac]
push dword [edi + 0xa8]
push ebx
push eax
call fcn.00445d70
push ebx
push esi
push edx
push eax
call fcn.00445db0
mov dword [edi + 0xa0], eax
mov ecx, eax
mov eax, edx
cmp eax, dword [edi + 0xc4]
mov dword [edi + 0xa4], edx
jl 0x4368d9
jg 0x4368cd
cmp ecx, dword [edi + 0xc0]
jbe 0x4368d9
mov dword [edi + 0xc0], ecx
mov dword [edi + 0xc4], eax
mov eax, dword [ebp - 0xc60]
mov dword [edi + 0xa8], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb8], eax
mov eax, dword [ebp - 0xc6c]
cmp eax, 0xffffffff
mov dword [ebp - 0xc54], ebx
je 0x436b2b
cmp eax, ebx
je 0x436b18
cmp eax, 0x102
je 0x436992
lea ecx, [ebp - 0xc6c]
push ecx
lea ecx, [ebp - 0xd04]
push ecx
lea ecx, [ebp - 0xcec]
push ecx
push dword [ebp - 0xc7c]
mov dword [ebp - 0xc6c], ebx
push edi
call fcn.00436d2f
cmp eax, ebx
jge 0x436978
mov dword [ebp - 0xc58], 0xb
jmp 0x436984
lea ecx, [ebp - 0xc50]
mov byte [ebp - 4], 0xb
call fcn.0040fa10
xor ebx, ebx
cmp dword [ebp - 0xc60], ebx
je 0x43671b
mov dword [ebp - 0xc58], 9
jmp 0x436b61
jle 0x436984
mov dword [ebp - 0xc54], 1
cmp dword [ebp - 0xc6c], ebx
je 0x436992
mov dword [ebp - 0xc5c], ebx
mov eax, dword [ebp - 0xc60]
sub eax, dword [edi + 0xd0]
cmp eax, 0x12c
jbe 0x4369c0
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x4369b4
mov eax, dword [ecx]
push ebx
push 6
push edi
call dword [eax]
mov eax, dword [ebp - 0xc60]
mov dword [edi + 0xd0], eax
mov eax, dword [ebp - 0xc60]
sub eax, dword [ebp - 0xc84]
cmp eax, 0xbb8
jbe 0x436abb
lea eax, [ebp - 0xcb4]
call fcn.004371a0
cmp eax, dword [edi + 4]
jae 0x436abb
lea eax, [ebp - 0xca4]
call fcn.004371a0
test eax, eax
je 0x436abb
mov eax, dword [ebp - 0xc60]
lea ecx, [ebp - 0xc70]
mov dword [ebp - 0xc84], eax
call fcn.0040fa30
mov byte [ebp - 4], 0xd
mov esi, dword [ebp - 0xc80]
push esi
lea ecx, [ebp - 0xc70]
call fcn.00414130
inc dword [esi + 0x38]
lea ecx, [ebp - 0xc70]
call fcn.00433de0
push eax
lea esi, [ebp - 0xc4c]
call fcn.00438bd3
pop ecx
push ebx
lea ebx, [ebp - 0xcec]
call fcn.00437857
mov esi, eax
test esi, esi
je 0x436aa4
mov ecx, dword [ebp - 0xc7c]
call fcn.004387cf
push dword [edi + 0x7c]
mov ebx, eax
push dword [edi + 0x78]
mov eax, dword [ebx]
push dword [esi + 0x14]
lea ecx, [ebp - 0xc4c]
push dword [esi + 0x10]
push dword [esi + 0x1c]
push dword [esi + 0x18]
push ecx
mov ecx, ebx
call dword [eax]
lea edi, [ebp - 0xc6c]
lea eax, [ebp - 0xcb4]
mov dword [esi + 0x20], ebx
mov dword [ebp - 0xc6c], esi
call fcn.00437c05
mov edi, dword [ebp - 0xc74]
inc dword [ebp - 0xc5c]
lea ecx, [ebp - 0xc70]
mov byte [ebp - 4], 0xb
call fcn.0040fa10
xor ebx, ebx
cmp dword [ebp - 0xc54], ebx
je 0x4367ae
lea eax, [ebp - 0xcb4]
call fcn.004371a0
test eax, eax
jne 0x4367ae
lea eax, [ebp - 0xca4]
call fcn.004371a0
cmp eax, ebx
je 0x436b3e
push dword [ebp - 0xc5c]
push eax
call fcn.00438ca7
add esp, 8
cmp dword [ebp - 0xc5c], 3
jle 0x4367ae
mov dword [ebp - 0xc58], 0xb
mov dword [edi + 0x68], 9
jmp 0x436b4d
mov dword [ebp - 0xc58], 0xa
mov dword [edi + 0x68], 8
jmp 0x436b4d
mov dword [edi + 0x68], 1
mov dword [ebp - 0xc58], 0xb
jmp 0x436b4d
call fcn.00438ca7
mov dword [ebp - 0xc58], 9
cmp dword [ebp - 0xc50], ebx
je 0x436b61
push dword [ebp - 0xc50]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
lea esi, [ebp - 0xd04]
call fcn.00437f30
cmp dword [ebp - 0xc58], 9
jne 0x436c0b
mov ecx, dword [ebp - 0xc64]
call fcn.00433de0
push eax
lea ecx, [ebp - 0xc54]
call fcn.0040f5f0
lea eax, [ebp - 0xc54]
push eax
mov byte [ebp - 4], 0xe
call fcn.004383cf
lea ecx, [ebp - 0xc54]
mov byte [ebp - 4], 0xb
call fcn.0040fa10
push 0x44d74c
lea eax, [ebp - 0xc54]
push eax
call fcn.004370a1
lea eax, [ebp - 0xc54]
push eax
push dword [ebp - 0xc64]
lea eax, [ebp - 0xc80]
push eax
mov byte [ebp - 4], 0xf
call fcn.00422610
mov ecx, dword [ebp - 0xc64]
add esp, 0xc
push 1
mov esi, eax
call fcn.00433de0
push eax
mov ecx, esi
call fcn.00433de0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0xc80]
call fcn.0040fa10
jmp 0x436c60
xor eax, eax
cmp dword [edi + 0x7c], eax
jl 0x436c6f
jg 0x436c19
cmp dword [edi + 0x78], eax
jbe 0x436c6f
cmp dword [edi + 0xf4], eax
jne 0x436c6f
mov ecx, dword [ebp - 0xc64]
call fcn.00433de0
push eax
lea ecx, [ebp - 0xc54]
call fcn.0040f5f0
mov byte [ebp - 4], 0x10
push dword [edi + 0x84]
lea eax, [ebp - 0xc54]
push dword [edi + 0x80]
lea ecx, [ebp - 0xcc4]
push dword [edi + 0x7c]
push dword [edi + 0x78]
push eax
call fcn.004381fb
lea ecx, [ebp - 0xc54]
mov byte [ebp - 4], 0xb
call fcn.0040fa10
mov esi, dword [ebp - 0xc7c]
call fcn.00438705
mov dword [edi + 0x90], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [ebp - 0xd04]
mov dword [edi + 0xb4], eax
call fcn.00437f30
lea ecx, [ebp - 0xcf4]
call fcn.0040fa10
lea esi, [ebp - 0xc94]
call fcn.00437185
lea esi, [ebp - 0xca4]
call fcn.00437185
lea esi, [ebp - 0xcb4]
call fcn.00437185
lea esi, [ebp - 0xcc4]
call fcn.00437185
lea ecx, [ebp - 0xcec]
call fcn.0040fa10
lea ecx, [ebp - 0xc78]
call fcn.0040fa10
lea ecx, [ebp - 0xc68]
call fcn.0040fa10
mov eax, dword [ebp - 0xc58]
call fcn.00445f13
ret 4