Function at 0x100071db0
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x400
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rbx, rcx
xor r14d, r14d
add rcx, 0x38
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [0x1000303e8]
lea ecx, [r14 + 4]
call fcn.1000526dc
lea r13d, [r14 + 2]
mov dword [rbx + 0x70], r14d
lea esi, [r14 + 1]
cmp dword [rbx + 0x60], r13d
je 0x100071e2a
lea rdx, [0x100030400]
mov ecx, r13d
call fcn.1000527a0
jmp 0x100072365
mov rdi, qword [rbx + 0x78]
or rcx, 0xffffffffffffffff
xor eax, eax
mov r12d, 3
mov dword [rbx + 0x60], r12d
repne scasb al, byte [rdi]
not rcx
sub rcx, rsi
lea rdi, [rsi + rcx]
mov rcx, rdi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r15, rax
cmp rax, r14
jne 0x100071e73
lea rdx, [0x100030440]
mov ecx, r13d
mov edi, 0x8007000e
call fcn.1000527a0
jmp 0x100072349
mov rdx, qword [rbx + 0x78]
cmp rdi, r14
je 0x100071eba
cmp rdi, 0x7fffffff
ja 0x100071eba
mov r8d, 0x7ffffffe
mov rcx, rax
sub r8, rdi
sub rdx, rax
lea rax, [r8 + rdi]
cmp rax, r14
je 0x100071eaf
mov al, byte [rdx + rcx]
cmp al, r14b
je 0x100071eaf
mov byte [rcx], al
add rcx, rsi
sub rdi, rsi
jne 0x100071e94
cmp rdi, r14
jne 0x100071eb7
sub rcx, rsi
mov byte [rcx], r14b
mov edi, 0x68
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
mov ecx, 0x104
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x2e0]
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0xb0], ecx
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x60], edi
call qword [rbx + 0x288]
cmp eax, r14d
jne 0x100071f51
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100030470]
cmp eax, r14d
mov ecx, 0x57
cmove eax, ecx
movzx edi, ax
or edi, 0x80070000
cmp eax, r14d
cmovle edi, eax
mov r8d, edi
mov ecx, r13d
call fcn.1000527f4
jmp 0x100072349
movzx r8d, word [rsp + 0x84]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbx + 0xa8]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [rbx + 0x290]
mov qword [rbx + 0xb0], rax
cmp rax, r14
jne 0x100071f9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100030498]
jmp 0x100071f27
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x4400200
lea rdx, [0x1000304c4]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [rbx + 0x2b0]
mov r12, rax
mov qword [rbx + 0xb8], rax
cmp rax, r14
jne 0x100071ff1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1000304c8]
jmp 0x100071f27
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 4
lea rdx, [0x1000304f8]
mov ecx, edi
call fcn.1000526dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [rbx + 0x2b8]
cmp eax, r14d
je 0x1000722e1
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x48]
mov edx, 0x20000013
mov rcx, r12
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], r14
call qword [rbx + 0x2c0]
cmp eax, r14d
je 0x1000722c6
mov eax, dword [rsp + 0x48]
sub eax, 0xc8
je 0x100072106
sub eax, 0xc9
je 0x1000720ac
sub eax, r13d
je 0x1000720ac
sub eax, esi
je 0x1000720a4
sub eax, 3
je 0x10007209c
sub eax, esi
je 0x100072094
cmp eax, 0x5c
je 0x10007208c
mov r8d, 0x800710e0
jmp 0x1000720b2
mov r8d, 0x8007003a
jmp 0x1000720b2
mov r8d, 0x8007041d
jmp 0x1000720b2
mov r8d, 0x80070041
jmp 0x1000720b2
mov r8d, 0x80070002
jmp 0x1000720b2
mov r8d, 0x80070005
lea rdx, [0x100030590]
mov ecx, r13d
call fcn.1000527f4
cmp dword [rsp + 0x48], 0x197
jne 0x1000720f7
mov rcx, qword [rbx + 0x1338]
mov r9d, 7
mov r8d, 0x2eee
mov rdx, r12
mov qword [rsp + 0x20], r14
call qword [rbx + 0x2a8]
cmp eax, 0x2f00
je 0x10007200e
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x100072344
lea rcx, [rbx + 0x38]
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x60], 3
je 0x100072183
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
mov edi, eax
cmp eax, r14d
cmove edi, ecx
mov rcx, qword [rbx + 0xb0]
call qword [rbx + 0x2a0]
mov rcx, qword [rbx + 0xb8]
mov qword [rbx + 0xb0], r14
call qword [rbx + 0x2a0]
movzx r8d, di
lea rdx, [0x1000305c8]
or r8d, 0x80070000
cmp edi, r14d
mov ecx, r13d
cmovle r8d, edi
mov qword [rbx + 0xb8], r14
call fcn.1000527f4
mov r12d, 0x80004004
mov edi, r12d
jmp 0x10007234f
lea rcx, [rbx + 0x38]
mov r13d, 4
mov dword [rbx + 0x60], r13d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r9, [rsp + 0x44]
lea r8, [rbx + 0x68]
mov edx, 0x20000005
mov rcx, r12
mov dword [rsp + 0x44], r13d
mov qword [rsp + 0x20], r14
call qword [rbx + 0x2c0]
cmp eax, r14d
jne 0x1000721d0
lea rdx, [0x1000305f0]
mov ecx, r13d
call fcn.1000527f4
or dword [rbx + 0x68], 0xffffffff
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
jmp 0x100072241
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x1000722a6
mov rcx, qword [rbx + 0xc0]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea rdx, [rbx + 0x320]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10007226f
mov eax, dword [rsp + 0x40]
add dword [rbx + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
sub edx, r14d
mul edx
mov ecx, edx
shr ecx, 6
test ecx, ecx
je 0x100072241
mov eax, dword [rbx + 0x6c]
xor edx, edx
div ecx
mov dword [rbx + 0x70], eax
lea r9, [rsp + 0x40]
lea rdx, [rbx + 0x320]
mov r8d, 0x1000
mov rcx, r12
call qword [rbx + 0x298]
test eax, eax
jne 0x1000721e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100030620]
jmp 0x10007227c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100030658]
xor r14d, r14d
cmp eax, r14d
lea ecx, [r14 + 0x57]
cmove eax, ecx
lea ecx, [r14 + 2]
movzx edi, ax
or edi, 0x80070000
cmp eax, r14d
cmovle edi, eax
mov r8d, edi
call fcn.1000527f4
jmp 0x1000722a9
xor r14d, r14d
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x60], r13d
mov r12d, 0x80004004
cmovne edi, r12d
jmp 0x10007234f
lea rcx, [rbx + 0x38]
mov edi, 0x8007000d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [0x100030558]
jmp 0x100071f41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
mov edi, eax
cmp eax, r14d
cmove edi, ecx
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x4c], 0x100
call qword [rbx + 0x2c8]
movzx r8d, di
lea rdx, [0x100030528]
or r8d, 0x80070000
cmp edi, r14d
mov ecx, r13d
cmovle r8d, edi
call fcn.1000527f4
mov edi, 0x80072efd
mov r12d, 0x80004004
cmp r15, r14
je 0x10007235c
mov rcx, r15
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp edi, r12d
je 0x100072444
lea rdx, [0x100030688]
mov ecx, 4
call fcn.1000526dc
cmp edi, r14d
mov r12d, 5
cmovge esi, r12d
mov dword [rbx + 0x64], edi
mov dword [rbx + 0x60], esi
mov rcx, qword [rbx + 0xc0]
cmp rcx, 0xffffffffffffffff
je 0x1000723a4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0xc0], 0xffffffffffffffff
cmp edi, r14d
jge 0x1000723c1
cmp dword [rbx + 0x90], r14d
je 0x1000723c1
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000723c8
mov dword [rbx + 0x90], r14d
mov rsi, qword [rbx + 0x318]
mov qword [rbx + 0x318], r14
cmp rsi, r14
je 0x1000723fd
mov edi, dword [rbx + 0x74]
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax + 0x18]
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x60], r12d
je 0x100072444
mov rcx, qword [rbx + 0x78]
mov rax, r14
cmp rcx, r14
je 0x10007241a
mov edx, 0x2f
call qword [sym.imp.msvcrt.dll_strrchr]
mov r9d, dword [rbx + 0x6c]
cmp rax, r14
lea r8, [0x1000306a0]
cmovne r8, rax
mov eax, dword [rbx + 0x68]
lea rdx, [0x1000306a8]
mov ecx, 4
mov dword [rsp + 0x20], eax
call fcn.1000527f4
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret