Function at 0x1000c7b0
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10189df2
push eax
mov dword fs:[0], esp
sub esp, 0x3c4
push ebx
push ebp
mov ebp, dword [esp + 0x3dc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x1000cc73
cmp dword [esp + 0x3e8], ebx
je 0x1000cc73
mov edi, dword [esp + 0x3ec]
cmp edi, ebx
je 0x1000cc73
mov esi, dword [esp + 0x3f0]
cmp esi, ebx
je 0x1000cc73
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.10054580
add esp, 8
mov eax, dword [0x10201328]
mov dword [esp + 0x3dc], ebx
cmp eax, ebx
je 0x1000c854
mov ecx, dword [esp + 0x3e8]
mov edx, dword [esp + 0x28]
push 0x57c
push ecx
push edx
push str.CMailSafeDoc::DoDecryptCompressFile_lpwszFile__s__lpwszVirtualPath__s___LINE:__d__n
push str.MailSafeDoc
push 4
push 0x10200a94
call fcn.1008b760
add esp, 0x1c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x40], ecx
push edi
mov ecx, esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], ebx
call fcn.10007e70
cmp eax, ebx
je 0x1000cc44
mov ecx, 0xe1
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x28]
push ebx
push 0x80
push 3
stosw word es:[edi], ax
push ebx
push 5
push closesocket
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000cc44
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov eax, dword [edx]
lea edx, [esp + 0x4c]
push eax
push ecx
lea eax, [esp + 0x38]
push edx
push eax
push edi
call fcn.1000b7c0
add esp, 0x14
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], ebx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], eax
call fcn.10089ed0
lea edx, [esp + 0x14]
mov byte [esp + 0x3dc], 1
push edx
push edi
call fcn.100f55c0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], ebx
je 0x1000cc34
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x1000cb19
push 0x101ec534
lea ecx, [esp + 0x20]
call fcn.10076d80
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x3dc], 2
call edi
push eax
push ebp
lea eax, [esp + 0x24]
push str._s__d.tmp
push eax
call fcn.1007a4a0
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.10054580
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push 1
push 2
push ebx
push eax
push ecx
mov byte [esp + 0x408], 3
call fcn.100f31a0
add esp, 0x2c
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x1000cb71
push 0x101ec534
lea ecx, [esp + 0x1c]
call fcn.10076d80
mov byte [esp + 0x3dc], 4
call edi
push eax
push ebp
lea edx, [esp + 0x20]
push str._s__d.bak
push edx
call fcn.1007a4a0
mov eax, dword [esp + 0x28]
push eax
push ebp
call fcn.10054eb0
add esp, 0x18
test eax, eax
je 0x1000cc01
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
call fcn.10054eb0
add esp, 8
test eax, eax
je 0x1000cbf3
push 0x101ec534
lea ecx, [esp + 0x14]
call fcn.10076d80
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x44]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x3e4], 5
call fcn.10007f40
test eax, eax
je 0x1000ca6d
mov ecx, dword [esp + 0x3ec]
push ecx
call fcn.10038fd0
add esp, 4
push eax
call edi
push eax
push 1
call fcn.10017640
add esp, 4
lea edx, [esp + 0x18]
push eax
push str._s_backup_d__s
push edx
call fcn.1007a4a0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
push 2
push eax
push ecx
call fcn.10054f70
add esp, 0x20
test eax, eax
jne 0x1000ca83
mov edx, dword [esp + 0x18]
push edx
call fcn.10055170
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10077290
mov eax, dword [esp + 0x3ec]
push eax
call fcn.100828d0
add esp, 4
lea ecx, [esp + 0x14]
mov edi, eax
xor esi, esi
call fcn.1008a0d0
test eax, eax
jbe 0x1000caaf
lea ecx, [esp + 0x14]
call fcn.1008a7d0
mov esi, eax
mov ebp, dword [esp + 0x3e8]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
push ebp
push esi
lea edx, [esp + 0x54]
push ecx
push edx
push eax
push edi
push 0xf
mov ecx, 0x101ec6e0
call fcn.1001a460
cmp dword [0x10201328], ebx
je 0x1000cafb
mov ecx, dword [esp + 0x10]
push ecx
push ebp
push str.CMailSafeDoc::DecryptFromCompressFile__s_:_backup_to__s___n
push str.MailSafeDoc
push 1
push 0x10200a94
call fcn.1008b760
add esp, 0x18
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 1
mov byte [esp + 0x3dc], 4
call fcn.10077520
jmp 0x1000cc01
cmp dword [0x10201328], ebx
je 0x1000cb48
mov edx, dword [esp + 0x3e8]
push eax
push edx
push ebp
push str.__s__CMailSafeDoc::DecryptFromCompressFile__s_:_No_Access_right__Result:_lu_n
push str.MailSafeDoc
push 4
push 0x10200a94
call fcn.1008b760
mov eax, dword [esp + 0x4c]
add esp, 0x1c
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
push edx
mov edx, dword [esp + 0x3ec]
push ebx
push 2
push eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push ecx
push edx
mov ecx, 0x101ec698
call fcn.10015170
jmp 0x1000cc34
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], ebx
call fcn.100efb50
mov edi, eax
mov eax, dword [0x10201328]
add esp, 8
cmp eax, ebx
je 0x1000cbc9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x3e8]
push edx
mov edx, dword [esp + 0x4c]
push eax
push edi
push ecx
mov eax, dword [edx]
push eax
push str.__s__CMailSafeDoc::DecryptFromCompressFile__s_:_Decrypt_file_failed___ESError:__d__ESLine:__d__LastError:__d__n
push str.MailSafeDoc
push 8
push 0x10200a94
call fcn.1008b760
add esp, 0x24
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x3c]
push edx
push eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x3f0]
push 2
push edi
push edx
push eax
mov ecx, 0x101ec698
call fcn.10015170
jmp 0x1000cc12
mov ecx, dword [esp + 0x18]
push ebp
push ecx
call fcn.10054eb0
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x3dc], 3
call fcn.10077520
lea ecx, [esp + 0x24]
mov byte [esp + 0x3dc], 2
call fcn.10077520
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3dc], 1
call fcn.10077520
lea ecx, [esp + 0x14]
mov byte [esp + 0x3dc], bl
call fcn.1008a030
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x1000cc59
push eax
call fcn.1017c36b
add esp, 4
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x3dc], 0xffffffff
call fcn.10077520
mov eax, dword [esp + 0x34]
jmp 0x1000cc75
xor eax, eax
mov ecx, dword [esp + 0x3d4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3d0
ret