Function at 0x10004be0
Capabilities:
Check for time delay via gettickcount
Create directory
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x1001c018]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
push 0
push str..DATAVGUARD_LOG_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.10005670
call fcn.1000a610
mov edi, 0x10121570
call fcn.10008700
test al, al
jne 0x10004c73
push 0x100
push 0
push 0x10127250
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x10004c40
mov cl, byte [eax + 0x10016800]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x10127250], cl
inc eax
cmp eax, 0x100
jb 0x10004c40
push 0x10127250
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 8
call fcn.1000d0e0
call fcn.1000b580
test al, al
jne 0x10004c9b
mov eax, 0x13
call fcn.1000e3c0
push eax
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 8
call fcn.1000d0e0
call fcn.1000b6d0
test al, al
jne 0x10004cab
mov eax, 0x14
jmp 0x10004c81
call fcn.1000e400
test al, al
jne 0x10004cbb
mov eax, 0x15
jmp 0x10004c81
call fcn.1000a8e0
test al, al
jne 0x10004ccb
mov eax, 0x16
jmp 0x10004c81
call fcn.10006fd0
test al, al
jne 0x10004cdb
mov eax, 0x17
jmp 0x10004c81
call fcn.1000adb0
test al, al
jne 0x10004ceb
mov eax, 0x2d
jmp 0x10004c81
call fcn.1000afe0
test al, al
jne 0x10004cfb
mov eax, 0x2e
jmp 0x10004c81
call fcn.10001460
test al, al
jne 0x10004d38
mov ecx, 4
push 0x1388
call fcn.10005ee0
push eax
push 2
mov eax, 0x10126620
call fcn.1000d510
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10011ccc
mov esp, ebp
pop ebp
ret
push 0x101215b6
mov ecx, 5
call fcn.10005ee0
push eax
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, 0x101263d0
call fcn.1000d510
movzx ecx, word [0x101215b4]
add esp, 0xc
push ecx
mov ecx, 0x10121594
call fcn.100014e0
test al, al
jne 0x10004d89
mov ecx, 6
jmp 0x10004d09
call fcn.10002e00
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 1
mov ebx, 0x1f4
mov edi, eax
call fcn.1000d140
add esp, 4
test al, al
jne 0x10004f1b
nop
call esi
sub eax, edi
cmp eax, 0xea60
ja 0x10004f62
call fcn.10001710
test al, al
jne 0x10004df1
call fcn.10001460
test al, al
je 0x10004df1
movzx edx, word [0x101215b4]
push edx
mov ecx, 0x10121594
call fcn.100014e0
test al, al
je 0x10004df1
call fcn.10002e00
jmp 0x10004f04
cmp dword [0x10126bbc], 0
je 0x10004f04
cmp dword [0x10126bc0], 0
je 0x10004f04
cmp dword [0x10126bc8], 0
je 0x10004f04
cmp dword [0x10126bcc], 0
je 0x10004f04
cmp dword [0x10126bd0], 0
je 0x10004f04
cmp dword [0x10126bc4], 0
je 0x10004f04
mov ecx, dword [0x1011c520]
sub ecx, dword [0x1011c51c]
mov eax, 0x7d8c42b3
imul ecx
mov ecx, dword [0x1011c510]
sub ecx, dword [0x1011c50c]
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x7a44c6b
imul ecx
mov ecx, dword [0x1011c4f0]
sub ecx, dword [0x1011c4ec]
sar edx, 3
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov dword [esp + 0xc], eax
mov eax, 0x38e38e39
imul ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [0x1011c530]
sub ecx, dword [0x1011c52c]
sar edx, 3
add eax, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, eax
mov eax, 0x7e07e07f
imul ecx
mov ecx, dword [0x1011c500]
sub ecx, dword [0x1011c4fc]
sar edx, 5
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x10126bd4]
add ecx, dword [0x10126be4]
sar edx, 4
add ecx, dword [0x10126be0]
mov eax, edx
add ecx, dword [0x10126bdc]
shr eax, 0x1f
add ecx, dword [0x10126bd8]
add ebx, edx
add eax, ebx
cmp eax, ecx
je 0x10004f1b
push 1
mov ebx, 0x1f4
call fcn.1000d140
add esp, 4
test al, al
je 0x10004db0
mov eax, dword [0x10126be4]
mov ecx, dword [0x10126be0]
mov edx, dword [0x10126bdc]
push eax
mov eax, dword [0x10126bd8]
push ecx
push edx
push eax
mov eax, 0x18
call fcn.1000e3c0
push eax
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 0x18
call fcn.1000b6d0
test al, al
jne 0x10004f6c
mov ecx, 0x14
jmp 0x10004d09
mov ecx, 7
jmp 0x10004d09
call fcn.100043f0
mov edi, 0x10121570
call fcn.10008810
call fcn.100089b0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x10126ef8
push 0
push 0
push 0x100048a0
push 0
push 0
call edi
push 0x10126efc
push 0
push 0
push 0x100047e0
push 0
push 0
mov dword [0x10126b6c], eax
call edi
push 0x10126f00
push 0
push 0
push 0x100046e0
push 0
push 0
mov dword [0x10126b70], eax
call edi
push 0x10126f08
push 0
push 0
push 0x100046a0
push 0
push 0
mov dword [0x10126b74], eax
call edi
push 0x10126f0c
push 0
push 0
push 0x10004590
push 0
push 0
mov dword [0x10126b78], eax
call edi
mov ecx, dword [0x10126b6c]
push 2
push ecx
mov dword [0x10126b7c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x7d0
push 1
push 0x10126b6c
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.100059d0
mov byte [0x10126edc], 1
call esi
mov dword [0x10126ee0], eax
call fcn.10001ed0
mov esi, 0x101263d0
call fcn.1000ce60
mov edi, 0x10121570
call fcn.10008900
mov eax, 0x2c
call fcn.1000e3c0
push eax
push 0
mov ecx, 0x1011c548
call fcn.10005790
add esp, 8
cmp dword [0x10126c00], 0
je 0x10005081
call fcn.1000e270
mov ecx, eax
call fcn.1000e070
call fcn.1000e4f0
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10011ccc
mov esp, ebp
pop ebp
ret