Function at 0x10004b60
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [0x10007004]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call fcn.10004a60
mov ecx, dword [esi + 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x6d
add ecx, esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call fcn.100034d0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10003650
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.10004a60
push esi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x4c]
mov eax, edi
test edi, edi
je 0x10004c1e
lea ecx, [ecx]
cmp word [eax + 0x10], 3
je 0x10004c1e
mov eax, dword [eax + 8]
test eax, eax
jne 0x10004c10
mov eax, edi
test edi, edi
je 0x10004c32
cmp word [eax + 0x10], 0xe
je 0x10004c32
mov eax, dword [eax + 8]
test eax, eax
jne 0x10004c24
mov eax, edi
test edi, edi
je 0x10004c46
cmp word [eax + 0x10], 0x10
je 0x10004c46
mov eax, dword [eax + 8]
test eax, eax
jne 0x10004c38
xor eax, eax
mov dword [ebp - 8], eax
mov eax, edi
test edi, edi
je 0x10004c64
cmp word [eax + 0x10], 0x18
je 0x10004c61
mov eax, dword [eax + 8]
test eax, eax
jne 0x10004c51
jmp 0x10004c64
mov dword [ebp - 8], eax
mov esi, dword [ebp - 0x40]
push ebx
mov dword [ebp - 4], esi
mov ecx, esi
test esi, esi
je 0x10004c7f
cmp word [ecx + 0x10], 3
je 0x10004ca3
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10004c71
mov ebx, dword [ebp - 0x38]
mov ecx, esi
test esi, esi
je 0x10004d25
lea esp, [esp]
cmp word [ecx + 0x10], 0xe
je 0x10004ced
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10004c90
jmp 0x10004d25
test ecx, ecx
je 0x10004c7f
mov edx, dword [ecx + 4]
test edx, edx
je 0x10004cb6
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
jmp 0x10004cbf
mov esi, dword [ecx + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], esi
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
test edx, edx
je 0x10004cdb
mov ebx, dword [ebp - 0x38]
mov dword [edx + 4], eax
mov eax, dword [ecx]
dec ebx
push 1
mov dword [ebp - 0x38], ebx
call dword [eax]
jmp 0x10004c82
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
dec ebx
push 1
mov dword [ebp - 0x38], ebx
call dword [eax]
jmp 0x10004c82
test ecx, ecx
je 0x10004d25
mov edx, dword [ecx + 4]
test edx, edx
je 0x10004d00
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
jmp 0x10004d09
mov esi, dword [ecx + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], esi
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
test edx, edx
je 0x10004d18
mov dword [edx + 4], eax
jmp 0x10004d1b
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
dec ebx
push 1
mov dword [ebp - 0x38], ebx
call dword [eax]
mov ecx, esi
test esi, esi
je 0x10004d78
jmp 0x10004d30
cmp word [ecx + 0x10], 0x10
je 0x10004d40
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10004d30
jmp 0x10004d78
test ecx, ecx
je 0x10004d78
mov edx, dword [ecx + 4]
test edx, edx
je 0x10004d53
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
jmp 0x10004d5c
mov esi, dword [ecx + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], esi
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
test edx, edx
je 0x10004d6b
mov dword [edx + 4], eax
jmp 0x10004d6e
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
dec ebx
push 1
mov dword [ebp - 0x38], ebx
call dword [eax]
mov ecx, esi
test esi, esi
je 0x10004dc8
mov edi, edi
cmp word [ecx + 0x10], 0x18
je 0x10004d90
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10004d80
jmp 0x10004dc8
test ecx, ecx
je 0x10004dc8
mov edx, dword [ecx + 4]
test edx, edx
je 0x10004da3
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
jmp 0x10004dac
mov esi, dword [ecx + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], esi
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 4]
test edx, edx
je 0x10004dbb
mov dword [edx + 4], eax
jmp 0x10004dbe
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
dec ebx
push 1
mov dword [ebp - 0x38], ebx
call dword [eax]
mov edx, esi
test esi, esi
je 0x10004e4d
mov edi, edi
cmp dword [edx + 0x2c], 7
jne 0x10004e10
mov esi, dword [edx + 0xc]
xor ecx, ecx
jmp 0x10004de0
mov al, byte [esi + ecx]
cmp al, byte [ecx + str.RT_DATA]
jne 0x10004e10
inc ecx
cmp ecx, 0xe
jb 0x10004de0
test edx, edx
je 0x10004e4a
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x10004e4a
mov eax, 0x2af8
cmp word [ecx + 0x10], ax
je 0x10004e19
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10004e01
jmp 0x10004e4a
mov edx, dword [edx + 8]
test edx, edx
jne 0x10004dd0
jmp 0x10004e4a
test ecx, ecx
je 0x10004e4a
mov esi, dword [ecx + 4]
mov eax, dword [ecx + 8]
test esi, esi
je 0x10004e2c
mov dword [esi + 8], eax
jmp 0x10004e2f
mov dword [edx + 0x14], eax
mov esi, dword [ecx + 8]
mov eax, dword [ecx + 4]
test esi, esi
je 0x10004e3e
mov dword [esi + 4], eax
jmp 0x10004e41
mov dword [edx + 0x18], eax
dec dword [edx + 0x1c]
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10004e98
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x10004e63
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
jmp 0x10004e66
mov edi, dword [edx + 8]
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10004e73
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x10004e7f
mov dword [eax + 8], edx
jmp 0x10004e87
mov esi, edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], esi
inc ebx
mov dword [edx + 4], eax
mov dword [edx + 8], 0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ebx
test edi, edi
je 0x10004eaf
lea esp, [esp]
mov ecx, edi
mov edi, dword [edi + 8]
mov eax, dword [ecx]
push 1
call dword [eax]
test edi, edi
jne 0x10004ea0
xor edi, edi
mov edx, esi
test esi, esi
je 0x10004ee7
jmp 0x10004ec0
cmp dword [edx + 0x2c], 7
jne 0x100050b1
mov esi, dword [edx + 0xc]
xor ecx, ecx
nop
mov al, byte [esi + ecx]
cmp al, byte [ecx + str.RT_DATA]
jne 0x100050b1
inc ecx
cmp ecx, 0xe
jb 0x10004ed0
mov edi, edx
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10004ffa
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10004fe9
mov esi, dword [eax + 0x28]
mov eax, dword [eax + 0x2c]
lea edx, [esi - 8]
add edx, eax
lea edi, [eax - 8]
mov ecx, dword [edx + 4]
mov ebx, edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx]
shr ebx, 2
and edi, 3
mov eax, ebx
mov dword [ebp - 8], ecx
mov ecx, edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ecx
mov edx, esi
test eax, eax
je 0x10004f62
mov edi, dword [ebp - 8]
mov al, byte [ebp - 0x20]
add al, bl
movzx ecx, al
mov eax, dword [edx]
ror eax, cl
add edx, 4
xor eax, edi
sub eax, ebx
mov dword [edx - 4], eax
dec ebx
jne 0x10004f40
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10004f78
mov eax, dword [ebp - 8]
lea esp, [esp]
xor byte [edx], al
lea edx, [edx + 1]
dec ecx
jne 0x10004f70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax]
mov dword [eax + 4], ecx
test ebx, ebx
je 0x10004fca
jmp 0x10004fb0
lea eax, [ecx + ebx]
movzx ecx, al
mov eax, dword [esi]
add eax, ebx
xor eax, edx
rol eax, cl
mov ecx, dword [ebp - 0x2c]
add esi, 4
mov dword [esi - 4], eax
dec ebx
jne 0x10004fb0
test edi, edi
je 0x10004fd8
mov edi, edi
xor byte [esi], dl
lea esi, [esi + 1]
dec edi
jne 0x10004fd0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10004f03
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10004ef5
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.100042d0
mov esi, dword [ebp - 0x2c]
push esi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test esi, esi
je 0x10005031
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push dword [ebp - 0x30]
mov edx, ebx
push ecx
lea ecx, [ebp - 0x40]
call fcn.10003d40
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
call fcn.100038e0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp + 0xc]
push ebx
push 0
push dword [section..data]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi]
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov eax, 0x14c
cmp word [ecx + 4], ax
jne 0x100050f3
movzx ebx, word [ecx + 6]
mov edi, dword [ecx + 0x28]
movzx eax, word [ecx + 0x14]
xor edx, edx
test ebx, ebx
je 0x100050f3
add ecx, 0x24
add ecx, eax
mov esi, dword [ecx]
cmp esi, edi
ja 0x100050a7
mov eax, dword [ecx - 4]
add eax, esi
cmp eax, edi
ja 0x100050c1
inc edx
add ecx, 0x28
cmp edx, ebx
jb 0x10005098
jmp 0x100050f3
mov edx, dword [edx + 8]
test edx, edx
jne 0x10004ec0
jmp 0x10004ee7
mov esi, dword [ecx + 8]
sub esi, dword [ecx]
mov eax, dword [ebp + 0xc]
add esi, edi
add esi, dword [eax]
mov bl, byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
cmp bl, 0x53
jne 0x100050f3
mov cl, byte [esi + 1]
add esi, 2
cmp cl, 0xb8
jne 0x100050f3
mov dword [esi], edx
mov al, byte [esi + 4]
lea esi, [esi + 5]
cmp al, 0xb8
je 0x100050e7
mov esi, dword [ebp - 4]
pop ebx
test esi, esi
je 0x1000510f
jmp 0x10005100
mov ecx, esi
mov esi, dword [esi + 8]
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
jne 0x10005100
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc