Function at 0x49fec4
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x6a
ja 0x4a00e3
dec esp
add al, ch
pop ss
pop es
das
jle 0x49ff19
ja 0x49fef5
mov ebp, 0xfdf06a5c
jmp 0xd5f7f519
imul byte [ebp + 0x47caa6d5]
add al, 0x60
or dword [ebx - 0x333e1b62], eax
mov dh, 0xe
xor dh, al
sub dword [ecx - 0x2f], edx
sbb ecx, ecx
dec ebx
xchg ebx, eax
push es
mov ebx, 0x1e6c679c
stc
add al, 0xbe
in eax, dx
jl 0x49ff00
in al, 0xc1
int3
out 0x17, al
pop ss
daa
xchg ebx, eax
jb 0x49ff4d
sub byte [ebx], ah
sbb ebp, dword [ebx + 6]
jmp dword [ebx + 0x3a]
insd dword es:[edi], dx
imul ebp, dword [edx - 4], 0x928e3b
cli
xor byte [esi + 0x20], cl
fcom dword [esi]
pop ebp
test eax, 0xdd7e5612
sub dword [ecx*4 + 0x2452f4af], edi
mov al, byte [0x244b3046]
invalid
lea ebp, [edi - 0x5fdbad0c]
inc esi
xor byte [ebx + 0x24], cl
adc byte [edi], dl
adc bl, byte [ebx - 0x7d297d7f]
jno 0x49ff5e
xor byte [ecx - 3], 0xc1
jmp 0x49ff63
shr ebx, 0xff
cmp dl, byte [eax - 0x669d86d6]
sar byte [ebp - 0x57], cl
or al, 0xe0
pop esi
and eax, 0xe0c93579
xchg edx, eax
dec edx
test eax, 0x471f332c
lahf
je 0x49ff36
invalid
fimul word [0x63c66e3c]
dec edi
aaa
test eax, 0xef495f41
inc ecx
sub eax, 0xfc7d7eb1
mov cl, 0x7e
jge 0x49ff8f
not dl
push edx
inc esi
std
push eax
scasd eax, dword es:[edi]
sub dl, bh
loop 0x49ffd6
enter 0xc99, 0xffffffffffffffb3
stosd dword es:[edi], eax
sub edx, esi
jle 0x49ffbb
aam 0x7e
insb byte es:[edi], dx
aam 0x35
mov ah, 0xff
mov ah, 4
cmp esi, ebx
adc eax, 0xd482122f
sub al, 0xaf
xor esi, dword [eax - 0x73]
jo 0x49ff4a
sub byte [ebx], dh
outsd dx, dword [esi]
aad 0xc6
cmp ebp, edi
mov al, ch
and bh, dl
mov ebx, dword [eax - 0x1f]
movsb byte es:[di], byte [si]
out dx, al
mov edi, 0xc1b46030
insd dword es:[edi], dx
push ds
pop ebx
cmc
sbb edx, dword [bp + di + 0x7f62]
clc
sal byte [edx + 0x3a], 1
inc esp
mov ah, 0xae
adc dword [ebp - 0x62], esp
dec ecx
jne 0x49ffc2
cmpsb byte [esi], byte es:[edi]
dec edx
jbe 0x49ffc2
out dx, al
cmp esi, esi
pop dword [edi - 0x38]
mov ah, 0x57
sub ch, byte [edx - 0x29b74850]
fidiv dword [esi - 0x65]
jno 0x49ff8f
push cs
add al, 0xe8
pop ecx
pop esi
xor bh, byte [ebx]
add eax, 0xd49cc5a3
movsd dword es:[edi], dword [esi]
mov bl, 0x38
or byte [esi], ch
jmp 0x4a006a
sti
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
inc ebp
cwde
or ah, byte [esi - 0x269df697]
pop edx
salc
pop eax
and al, byte [ebx + 0x11]
push es
aas
mov edx, 0x429e4d89
inc eax
jbe 0x4a00f7
adc al, 0x1f
sbb dword [esi], eax
pop ds
jmp 0x6e9751cd
mov eax, dword [edi + 0x10]
lea ebx, [eax*2 + 2]
cmp ebx, 1
jge 0x4a0100
push 0x553e58
mov ecx, esi
call fcn.004017f5
jmp 0x4a016b
push ebx
call fcn.00417f6a
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4a00f2
push ebx
push 0
push eax
call fcn.0041b930
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4a0122
mov edi, dword [edi]
xor eax, eax
push eax
push eax
push ebx
mov ebx, dword [ebp - 4]
push ebx
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea ecx, [ebp - 0x20]
call fcn.004017f5
push ebx
call fcn.0041b9c0
and dword [esi + 0x10], 0
pop ecx
lea eax, [ebp - 0x20]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00401f8b
lea ecx, [ebp - 0x20]
call fcn.0040187f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret