Function at 0x8be050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1394
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x207
lea ecx, [ebp - 0xf57]
mov edi, edx
push ebx
push ecx
mov dword [ebp - 0x1374], esi
mov dword [ebp - 0x1378], edi
mov dword [ebp - 0x136c], eax
mov byte [ebp - 0xf58], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x40f
lea edx, [ebp - 0x937]
push ebx
push edx
mov byte [ebp - 0x938], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1370], ebx
mov dword [ebp - 0x1384], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp esi, ebx
je 0x8be1e6
mov al, byte [esi]
cmp al, bl
je 0x8be1e6
cmp edi, ebx
je 0x8be1e6
cmp byte [edi], bl
je 0x8be1e6
cmp al, 0x5c
jne 0x8be135
cmp byte [esi + 1], al
jne 0x8be135
push ebx
push ebx
push ebx
xor edx, edx
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8be135
mov dword [ebp - 0x1384], 1
cmp dword [0xbc27fc], ebx
je 0x8be1c0
mov eax, dword [ebp - 0x136c]
cmp eax, ebx
jne 0x8be15a
lea ecx, [ebp - 0x1388]
push ecx
push esi
call fcn.008bdc70
jmp 0x8be167
lea edx, [ebp - 0x1388]
push edx
push eax
call fcn.008bdcc0
add esp, 8
cmp eax, ebx
jne 0x8be18c
mov eax, dword [ebp - 0x1388]
push eax
push esi
lea ecx, [ebp - 0x938]
push str.Into_RenameInfectedFile__fn:__s__size:__ld_
push ecx
call fcn.00a78f30
add esp, 0x10
jmp 0x8be1a1
push esi
lea edx, [ebp - 0x938]
push str.Into_RenameInfectedFile__fn:__s__File_Absent_
push edx
call fcn.00a78f30
add esp, 0xc
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [ebp - 0x938]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea esp, [esp]
lea ebx, [ebp - 0x110]
mov eax, esi
call fcn.0096ff30
mov edi, ebx
call fcn.008bdbd0
test eax, eax
je 0x8be1f9
cmp dword [ebp - 0x1384], 1
jne 0x8be1e6
call fcn.00987380
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov eax, dword [0xbc21bc]
cmp eax, 2
jne 0x8be2e9
mov esi, dword [ebp - 0x136c]
test esi, esi
jne 0x8be25c
push 0x207
lea edx, [ebp - 0xc47]
push esi
push edx
mov byte [ebp - 0xc48], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0x1374]
add esp, 0xc
push 0xbc27e8
push esi
lea eax, [ebp - 0xc48]
push str._s._s
push eax
call fcn.00a78f30
lea ecx, [ebp - 0xc48]
push ecx
push esi
call fcn.008bdd10
add esp, 0x18
jmp 0x8be2a3
xor edx, edx
push 0x40e
push edx
lea eax, [ebp - 0x1366]
push eax
mov word [ebp - 0x1368], dx
call fcn.00a7ffb0
add esp, 0xc
push 0xbc27e8
push esi
push str._s._S
lea edx, [ebp - 0x1368]
call fcn.00853e40
add esp, 0xc
lea ecx, [ebp - 0x1368]
push ecx
push esi
call fcn.008bdd60
add esp, 8
mov dword [ebp - 0x1370], eax
test eax, eax
jne 0x8be6ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x938]
push str.Error_In_MoveFileEx._Error_Code:__d
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x938]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8be6ba
cmp eax, 1
jne 0x8be6ba
mov eax, str.C:PROGRA2eScanInfected
call fcn.00974c00
mov eax, dword [0xbc27fc]
test eax, eax
je 0x8be31a
push 0
push eax
push str.Creating_File_Backup__1_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
mov dword [ebp - 0x1380], esi
mov dword [ebp - 0x1370], 0
call ebx
sub eax, esi
cmp eax, 0x7d0
jae 0x8be6df
jmp 0x8be350
mov esi, dword [ebp - 0x136c]
mov dword [ebp - 0x137c], 0
test esi, esi
jne 0x8be39d
mov edx, dword [0xb3811c]
mov eax, dword [ebp + 8]
push 0xb52310
push esi
push esi
lea ecx, [ebp - 0x137c]
push ecx
mov ecx, dword [ebp - 0x1378]
push edx
mov edx, dword [ebp - 0x1374]
push eax
push esi
push str.C:PROGRA2eScanInfected
push ecx
push edx
call fcn.00920270
add esp, 0x28
mov ebx, eax
jmp 0x8be3ed
mov ebx, esi
call fcn.00970430
mov edi, eax
test edi, edi
je 0x8be3f2
mov ecx, dword [0xb3811c]
mov edx, dword [ebp + 8]
push 0xb52310
push 1
push esi
lea eax, [ebp - 0x137c]
push eax
mov eax, dword [ebp - 0x1378]
push ecx
push edx
push 0
push str.C:PROGRA2eScanInfected
push eax
push edi
call fcn.00920270
add esp, 0x28
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 1
je 0x8be428
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x8be6e5
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1380]
cmp eax, 0x7d0
jb 0x8be350
jmp 0x8be6e5
push 0xb52310
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x137c]
shr eax, 0x14
add dword [0xbd5ecc], eax
mov eax, dword [ebp - 0x137c]
and eax, 0xfffff
add dword [0xbd5fd4], eax
mov ecx, dword [0xbd5fd4]
cmp ecx, 0x100000
jl 0x8be494
mov eax, dword [0xbd5fd4]
cdq
and edx, 0xfffff
add eax, edx
sar eax, 0x14
add dword [0xbd5ecc], eax
mov edx, dword [0xbd5fd4]
and edx, 0x800fffff
jns 0x8be48e
dec edx
or edx, 0xfff00000
inc edx
mov dword [0xbd5fd4], edx
cmp dword [0xbc27fc], 0
je 0x8be4f5
mov eax, dword [0xbd5ecc]
fild dword [ebp - 0x137c]
mov ecx, dword [ebp - 0x137c]
push eax
test ecx, ecx
jge 0x8be4b9
fadd qword [0xb0baa8]
fmul qword [0xb0bb38]
sub esp, 8
lea edx, [ebp - 0xa40]
fstp qword [esp]
push str.CreateQuarantineFile__filesize:__.2f_MB__Success._Quarantine_Folder_Size:___u_MB_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0xa40]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, 1
cmp dword [0xbd59a4], ebx
jne 0x8be677
cmp dword [0xb8db34], 0
jbe 0x8be677
mov esi, dword [0xbd5ecc]
mov edi, dword [0xbd5fd4]
mov eax, dword [0xb8db34]
cmp esi, eax
ja 0x8be536
jne 0x8be677
test edi, edi
jbe 0x8be677
push 0x207
lea edx, [ebp - 0x527]
push 0
push edx
mov dword [ebp - 0x1378], 0
mov byte [ebp - 0x528], 0
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1370], esi
xor eax, eax
jmp 0x8be570
mov cl, byte [eax + str.C:PROGRA2eScanInfected]
mov byte [ebp + eax - 0x528], cl
add eax, ebx
test cl, cl
jne 0x8be570
lea ecx, [ebp - 0x528]
call fcn.00960910
lea eax, [ebp - 0x528]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8be595
mov ecx, dword [str.VirBackup.dit]
mov edx, dword [0xac7fd0]
mov dword [eax], ecx
mov ecx, dword [0xac7fd4]
mov dword [eax + 4], edx
mov dx, word [0xac7fd8]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
push ebx
push 0
lea edx, [ebp - 0x1378]
lea ecx, [ebp - 0x528]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8be677
cmp dword [ebp - 0x1378], eax
jbe 0x8be677
mov eax, dword [0xb8db34]
mov dword [ebp - 0x1394], edi
fild dword [ebp - 0x1394]
push eax
test edi, edi
jge 0x8be609
fadd qword [0xb0baa8]
fmul qword [0xb0bb38]
mov dword [ebp - 0x1394], esi
fild dword [ebp - 0x1394]
test esi, esi
jge 0x8be625
fadd qword [0xb0baa8]
faddp st(1)
sub esp, 8
lea ecx, [ebp - 0xd50]
fstp qword [esp]
push str.Clearing_Quarantine_Folder_as_its_size___.2f_MB__exceeds_MaxQuarantineFolderSizeInMB___u_MB_...
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push ebx
lea edx, [ebp - 0xd50]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0x1370]
push eax
push ebx
lea ecx, [ebp - 0x528]
call fcn.008c1300
mov ecx, dword [ebp - 0x1370]
add esp, 0x18
mov dword [0xbd5ecc], ecx
push 0xb52310
mov dword [ebp - 0x1370], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0xbc27fc], 0
je 0x8be6ba
lea ecx, [ebp - 0x938]
push str.CreateQuarantineFile_returns_TRUE...
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x938]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [ebp - 0x1384], 1
jne 0x8be6c8
call fcn.00987380
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1370]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x136c]
xor edi, edi
cmp dword [0xbc27fc], edi
je 0x8be7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x938]
push str.Error_In_CreateQuarantineFile._Reason:__d
push edx
call fcn.00a78f30
add esp, 0xc
push edi
push 1
lea eax, [ebp - 0x938]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, edi
jne 0x8be741
mov edx, dword [ebp - 0x1374]
lea ecx, [ebp - 0x136c]
push ecx
push edx
call fcn.008bdc70
add esp, 8
jmp 0x8be78d
xor ebx, ebx
mov dword [ebp - 0x1390], edi
call fcn.00968110
test eax, eax
je 0x8be763
lea eax, [ebp - 0x1390]
push eax
call fcn.009681c0
add esp, 4
mov ebx, eax
lea ecx, [ebp - 0x136c]
push ecx
mov ecx, esi
call fcn.0095a000
add esp, 4
mov edi, eax
test ebx, ebx
je 0x8be789
mov edx, dword [ebp - 0x1390]
push edx
call fcn.00968240
add esp, 4
mov eax, edi
xor edi, edi
push edi
cmp eax, edi
jne 0x8be7b5
cmp dword [ebp - 0x136c], edi
jne 0x8be7a7
mov eax, dword [0xbc27fc]
push eax
push str.Error_File_Backup_1_._File_Present__ZeroByte_.
jmp 0x8be7c1
mov ecx, dword [0xbc27fc]
push ecx
push str.Error_File_Backup_1_._File_Present.
jmp 0x8be7c1
mov edx, dword [0xbc27fc]
push edx
push str.Error_File_Backup_1_._File_Absent
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, edi
jne 0x8be7ec
mov ecx, dword [ebp - 0x1374]
lea eax, [ebp - 0x136c]
push eax
push ecx
call fcn.008bdc70
add esp, 8
mov ebx, eax
jmp 0x8be838
xor ebx, ebx
mov dword [ebp - 0x138c], edi
call fcn.00968110
test eax, eax
je 0x8be80e
lea edx, [ebp - 0x138c]
push edx
call fcn.009681c0
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x136c]
push eax
mov ecx, esi
call fcn.0095a000
add esp, 4
mov edi, eax
test ebx, ebx
je 0x8be834
mov ecx, dword [ebp - 0x138c]
push ecx
call fcn.00968240
add esp, 4
mov ebx, edi
xor edi, edi
cmp dword [0xbc27fc], edi
je 0x8be888
push 0x103
lea edx, [ebp - 0x217]
push edi
push edx
mov byte [ebp - 0x218], 0
call fcn.00a7ffb0
add esp, 0xc
push ebx
lea eax, [ebp - 0x218]
push str.isfilepresentResult___d
push eax
call fcn.00a78f30
add esp, 0xc
push edi
push 1
lea ecx, [ebp - 0x218]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp ebx, edi
jne 0x8be6ba
cmp esi, edi
jne 0x8be8da
xor esi, esi
mov dword [ebp - 0x1380], edi
call fcn.00968110
test eax, eax
je 0x8be8b6
lea edx, [ebp - 0x1380]
push edx
call fcn.009681c0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1374]
call fcn.0094dd20
mov ebx, eax
cmp esi, edi
je 0x8be8d6
mov eax, dword [ebp - 0x1380]
push eax
call fcn.00968240
add esp, 4
mov eax, ebx
jmp 0x8be91a
xor ebx, ebx
mov dword [ebp - 0x1374], edi
call fcn.00968110
test eax, eax
je 0x8be8fc
lea ecx, [ebp - 0x1374]
push ecx
call fcn.009681c0
add esp, 4
mov ebx, eax
mov eax, esi
call fcn.0094de20
mov esi, eax
cmp ebx, edi
je 0x8be918
mov edx, dword [ebp - 0x1374]
push edx
call fcn.00968240
add esp, 4
mov eax, esi
cmp eax, edi
jne 0x8be6ba
push 0x103
lea eax, [ebp - 0x31f]
push 0
push eax
mov byte [ebp - 0x320], 0
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
mov edi, eax
lea esi, [ebp - 0x320]
call fcn.00960a40
add esp, 4
mov ecx, esi
push ecx
lea edx, [ebp - 0x938]
push str.Delete_After_Quarantine_fails__Reason:__s
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x938]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8be6ba