Function at 0x46a160
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1384
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x207
lea eax, [ebp - 0x134f]
push 0
push eax
mov dword [ebp - 0x135c], esi
mov dword [ebp - 0x1360], edi
mov dword [ebp - 0x1354], ebx
mov byte [ebp - 0x1350], 0
call fcn.005dfd60
push 0x40f
lea ecx, [ebp - 0x823]
push 0
push ecx
mov byte [ebp - 0x824], 0
call fcn.005dfd60
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call fcn.005dfd60
xor eax, eax
add esp, 0x24
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x136c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6e9080], eax
test esi, esi
je 0x46a31e
mov al, byte [esi]
test al, al
je 0x46a31e
test edi, edi
je 0x46a31e
cmp byte [edi], 0
je 0x46a31e
cmp al, 0x5c
jne 0x46a244
cmp byte [esi + 1], al
jne 0x46a244
push 0
push 0
push 0
call fcn.00504d70
test eax, eax
jne 0x46a244
mov dword [ebp - 0x136c], 1
cmp dword [0x71de6c], 0
je 0x46a2ca
push 0
push 0
push 0
test ebx, ebx
jne 0x46a266
lea eax, [ebp - 0x1378]
push eax
push esi
call fcn.00454b90
jmp 0x46a273
lea ecx, [ebp - 0x1378]
push ecx
push ebx
call fcn.00454bf0
add esp, 0x14
test eax, eax
jne 0x46a298
mov edx, dword [ebp - 0x1378]
push edx
push esi
lea eax, [ebp - 0x824]
push str.Into_RenameInfectedFile__fn:__s__size:__ld_
push eax
call fcn.005dfb23
add esp, 0x10
jmp 0x46a2ad
push esi
lea ecx, [ebp - 0x824]
push str.Into_RenameInfectedFile__fn:__s__File_Absent_
push ecx
call fcn.005dfb23
add esp, 0xc
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x824]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x46a2ec
cmp byte [eax], 0
je 0x46a2ec
lea edx, [ebp - 0x108]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x46a2e0
jmp 0x46a2fc
lea ecx, [ebp - 0x108]
push ecx
push esi
call fcn.004da790
add esp, 8
lea edx, [ebp - 0x108]
push esi
push edx
call fcn.00454b00
add esp, 8
test eax, eax
je 0x46a331
cmp dword [ebp - 0x136c], 1
jne 0x46a31e
call fcn.00504780
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov eax, dword [0x71d82c]
cmp eax, 2
jne 0x46a40a
test ebx, ebx
jne 0x46a383
push 0x207
lea eax, [ebp - 0xd37]
push ebx
push eax
mov byte [ebp - 0xd38], bl
call fcn.005dfd60
push 0x71de58
push esi
lea ecx, [ebp - 0xd38]
push str._s._s
push ecx
call fcn.005dfb23
push 3
lea edx, [ebp - 0xd38]
push edx
push esi
call fcn.00454c50
jmp 0x46a3c4
xor eax, eax
push 0x40e
push eax
lea ecx, [ebp - 0x1146]
push ecx
mov word [ebp - 0x1148], ax
call fcn.005dfd60
push 0x71de58
push ebx
lea edx, [ebp - 0x1148]
push str._s._S
push edx
call fcn.004085b0
push 3
lea eax, [ebp - 0x1148]
push eax
push ebx
call fcn.00454ca0
add esp, 0x28
mov dword [ebp - 0x1358], eax
test eax, eax
jne 0x46a879
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x824]
push str.Error_In_MoveFileEx._Error_Code:__d
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x824]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x46a879
cmp eax, 1
jne 0x46a879
push 0x71da48
call fcn.004eab20
mov eax, dword [0x71de6c]
add esp, 4
test eax, eax
je 0x46a43e
push 0
push eax
push str.Creating_File_Backup__1_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov dword [ebp - 0x1368], esi
mov dword [ebp - 0x1358], 0
call edi
sub eax, esi
cmp eax, 0x7d0
jae 0x46a543
mov ebx, dword [ebp + 0x10]
lea ebx, [ebx]
cmp dword [ebp - 0x1354], 0
mov dword [ebp - 0x1364], 0
jne 0x46a4bc
mov ecx, dword [0x685b88]
mov edx, dword [ebp - 0x1360]
push 0x6e8b58
push 0
push 0
lea eax, [ebp - 0x1364]
push eax
mov eax, dword [ebp - 0x135c]
push ecx
push ebx
push 0
push 0x71da48
push edx
push eax
call fcn.004b3540
add esp, 0x28
mov edi, eax
jmp 0x46a50d
mov ecx, dword [ebp - 0x1354]
push ecx
call fcn.004da8e0
mov esi, eax
add esp, 4
test esi, esi
je 0x46a516
mov edx, dword [ebp - 0x1354]
mov ecx, dword [0x685b88]
push 0x6e8b58
push 1
push edx
mov edx, dword [ebp - 0x1360]
lea eax, [ebp - 0x1364]
push eax
push ecx
push ebx
push 0
push 0x71da48
push edx
push esi
call fcn.004b3540
push esi
mov edi, eax
call fcn.004da940
add esp, 0x2c
cmp edi, 1
je 0x46a5df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x46a543
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x1368]
cmp eax, 0x7d0
jb 0x46a470
xor esi, esi
cmp dword [0x71de6c], esi
je 0x46a949
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x824]
push str.Error_In_CreateQuarantineFile._Reason:__d
push edx
call fcn.005dfb23
push esi
push 1
lea eax, [ebp - 0x824]
push eax
push 0x6aec98
call fcn.004311c0
mov ebx, dword [ebp - 0x1354]
add esp, 0x1c
cmp ebx, esi
jne 0x46a89e
mov dword [ebp - 0x1354], esi
call fcn.004d96c0
test eax, eax
je 0x46a5ae
lea ecx, [ebp - 0x1354]
push ecx
call fcn.004f77e0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x135c]
push 0
push 0
push 0
lea edx, [ebp - 0x1360]
push edx
push eax
call fcn.004ec5a0
add esp, 0x14
mov edi, eax
test esi, esi
je 0x46a8e9
mov ecx, dword [ebp - 0x1354]
jmp 0x46a8e0
push 0x6e8b58
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x1364]
shr eax, 0x14
add dword [0x732c94], eax
mov eax, dword [ebp - 0x1364]
and eax, 0xfffff
add dword [0x732d9c], eax
mov eax, dword [0x732d9c]
cmp eax, 0x100000
jl 0x46a649
mov eax, dword [0x732d9c]
cdq
and edx, 0xfffff
add eax, edx
sar eax, 0x14
add dword [0x732c94], eax
mov ecx, dword [0x732d9c]
and ecx, 0x800fffff
jns 0x46a643
dec ecx
or ecx, 0xfff00000
inc ecx
mov dword [0x732d9c], ecx
cmp dword [0x71de6c], 0
je 0x46a6a9
mov edx, dword [0x732c94]
fild dword [ebp - 0x1364]
mov eax, dword [ebp - 0x1364]
push edx
test eax, eax
jge 0x46a66f
fadd qword [0x60ecc0]
fmul qword [0x612ca8]
sub esp, 8
lea ecx, [ebp - 0x928]
fstp qword [esp]
push str.CreateQuarantineFile__filesize:__.2f_MB__Success._Quarantine_Folder_Size:___u_MB_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x928]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov ebx, 1
cmp dword [0x73276c], ebx
jne 0x46a837
cmp dword [0x6e91a0], 0
jbe 0x46a837
mov esi, dword [0x732c94]
mov edi, dword [0x732d9c]
mov eax, dword [0x6e91a0]
cmp esi, eax
ja 0x46a6ea
jne 0x46a837
test edi, edi
jbe 0x46a837
push 0x207
lea ecx, [ebp - 0x413]
push 0
push ecx
mov dword [ebp - 0x135c], 0
mov byte [ebp - 0x414], 0
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x1358], esi
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x71da48]
mov byte [ebp + eax - 0x414], cl
add eax, ebx
test cl, cl
jne 0x46a720
lea edx, [ebp - 0x414]
push edx
call fcn.004e24e0
lea eax, [ebp - 0x414]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46a750
mov ecx, dword [str.VirBackup.dit]
mov edx, dword [0x6253d8]
mov dword [eax], ecx
mov ecx, dword [0x6253dc]
push ebx
mov dword [eax + 4], edx
mov dx, word [0x6253e0]
push 0
mov dword [eax + 8], ecx
push 0
mov word [eax + 0xc], dx
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x46a837
cmp dword [ebp - 0x135c], eax
jbe 0x46a837
mov edx, dword [0x6e91a0]
mov dword [ebp - 0x1384], edi
fild dword [ebp - 0x1384]
push edx
test edi, edi
jge 0x46a7cb
fadd qword [0x60ecc0]
fmul qword [0x612ca8]
mov dword [ebp - 0x1384], esi
fild dword [ebp - 0x1384]
test esi, esi
jge 0x46a7e7
fadd qword [0x60ecc0]
faddp st(1)
sub esp, 8
lea eax, [ebp - 0xa2c]
fstp qword [esp]
push str.Clearing_Quarantine_Folder_as_its_size___.2f_MB__exceeds_MaxQuarantineFolderSizeInMB___u_MB_...
push eax
call fcn.005dfb23
push 0
push ebx
lea ecx, [ebp - 0xa2c]
push ecx
push 0x6aec98
call fcn.004311c0
lea edx, [ebp - 0x1358]
push edx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00457210
mov ecx, dword [ebp - 0x1358]
add esp, 0x30
mov dword [0x732c94], ecx
push 0x6e8b58
mov dword [ebp - 0x1358], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x71de6c], 0
je 0x46a879
lea eax, [ebp - 0x824]
push str.CreateQuarantineFile_returns_TRUE...
push eax
call fcn.005dfb23
push 0
push ebx
lea ecx, [ebp - 0x824]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
cmp dword [ebp - 0x136c], 1
jne 0x46a887
call fcn.00504780
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1358]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1380], esi
call fcn.004d96c0
test eax, eax
je 0x46a8be
lea edx, [ebp - 0x1380]
push edx
call fcn.004f77e0
add esp, 4
mov esi, eax
push 0
push 0
push 0
lea eax, [ebp - 0x1360]
push eax
push ebx
call fcn.004e87b0
add esp, 0x14
mov edi, eax
test esi, esi
je 0x46a8e9
mov ecx, dword [ebp - 0x1380]
push ecx
call fcn.004f7860
add esp, 4
mov eax, edi
push 0
test eax, eax
jne 0x46a92e
cmp dword [ebp - 0x1360], edi
jne 0x46a914
mov edx, dword [0x71de6c]
push edx
push str.Error_File_Backup_1_._File_Present__ZeroByte_.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x46a94f
mov eax, dword [0x71de6c]
push eax
push str.Error_File_Backup_1_._File_Present.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x46a94f
mov ecx, dword [0x71de6c]
push ecx
push str.Error_File_Backup_1_._File_Absent
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x46a94f
mov ebx, dword [ebp - 0x1354]
xor edi, edi
test ebx, ebx
jne 0x46a99f
mov dword [ebp - 0x137c], edi
call fcn.004d96c0
test eax, eax
je 0x46a975
lea edx, [ebp - 0x137c]
push edx
call fcn.004f77e0
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x135c]
push 0
push 0
push 0
lea eax, [ebp - 0x1360]
push eax
push ecx
call fcn.004ec5a0
add esp, 0x14
mov esi, eax
test edi, edi
je 0x46a9ea
mov edx, dword [ebp - 0x137c]
jmp 0x46a9e1
mov dword [ebp - 0x1370], edi
call fcn.004d96c0
test eax, eax
je 0x46a9bf
lea eax, [ebp - 0x1370]
push eax
call fcn.004f77e0
add esp, 4
mov edi, eax
push 0
push 0
push 0
lea ecx, [ebp - 0x1360]
push ecx
push ebx
call fcn.004e87b0
add esp, 0x14
mov esi, eax
test edi, edi
je 0x46a9ea
mov edx, dword [ebp - 0x1370]
push edx
call fcn.004f7860
add esp, 4
xor edi, edi
cmp dword [0x71de6c], edi
je 0x46aa1d
push esi
lea eax, [ebp - 0xb30]
push str.isfilepresentResult___d
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0xb30]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp esi, edi
jne 0x46a879
xor esi, esi
cmp ebx, edi
jne 0x46aa69
mov dword [ebp - 0x1374], edi
call fcn.004d96c0
test eax, eax
je 0x46aa4b
lea edx, [ebp - 0x1374]
push edx
call fcn.004f77e0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x135c]
push eax
call fcn.004e0670
add esp, 4
mov edi, eax
test esi, esi
je 0x46aaa7
mov ecx, dword [ebp - 0x1374]
push ecx
jmp 0x46aa9f
mov dword [ebp - 0x1368], edi
call fcn.004d96c0
test eax, eax
je 0x46aa89
lea edx, [ebp - 0x1368]
push edx
call fcn.004f77e0
add esp, 4
mov esi, eax
push ebx
call fcn.004e0740
add esp, 4
mov edi, eax
test esi, esi
je 0x46aaa7
mov eax, dword [ebp - 0x1368]
push eax
call fcn.004f7860
add esp, 4
mov eax, edi
test eax, eax
jne 0x46a879
push 0x103
lea ecx, [ebp - 0x20b]
push edi
push ecx
mov byte [ebp - 0x20c], 0
call fcn.005dfd60
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.004d8c20
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x824]
push str.Delete_After_Quarantine_fails__Reason:__s
push ecx
call fcn.005dfb23
push edi
push 1
lea edx, [ebp - 0x824]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x30
jmp 0x46a879