Function at 0x47c3a0
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x4df798]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0xc], 0x640
mov dword [ebp - 0x10], 4
mov dword [ebp - 4], 0x190
mov dword [ebp - 0x14], 0
jmp 0x47c3e0
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x168]
movzx edx, byte [ecx + 4]
cmp dword [ebp - 0x14], edx
jge 0x47ca24
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x47c512
mov eax, dword [ebp - 0x168]
movzx ecx, byte [eax + 4]
cmp ecx, 1
jne 0x47c512
mov dword [ebp - 0x1c], 0
push 0x4bf4e0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.ReadMem.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x640
push 0x648
call fcn.0042c7e8
add esp, 4
mov dword [ebp - 0x158], eax
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x18], edx
mov eax, 1
test eax, eax
je 0x47c4de
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
push ecx
call fcn.00401f50
add esp, 4
cmp eax, 0xfa0
jle 0x47c490
jmp 0x47c4de
push 0x4bf4f8
push str.PMOut
call fcn.00454db2
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47c4dc
mov edx, dword [ebp - 0x1c]
push edx
push 0x640
push 1
mov eax, dword [ebp - 0x18]
push eax
call fcn.00452797
add esp, 0x10
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0045282b
add esp, 4
cmp dword [ebp - 0x28], 0x5dc
jb 0x47c4dc
jmp 0x47c4de
jmp 0x47c462
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x15c]
push eax
call fcn.0042c7f3
add esp, 4
push 0x640
mov ecx, dword [ebp - 0x18]
push ecx
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.004765f0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47c7ad
mov dword [ebp - 0x130], 0
push 0x40
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00451f70
add esp, 0xc
mov dword [ebp - 0xe4], 0
xor ecx, ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0x130], 0x44
xor edx, edx
mov word [ebp - 0x100], dx
mov dword [ebp - 0x3c], 2
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov cx, word [ebp - 0x2e]
mov word [ebp - 0xd4], cx
mov dword [ebp - 0xcc], 0
push 0x640
call fcn.0042c7e8
add esp, 4
mov dword [ebp - 0x160], eax
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x40], edx
push 0x640
push 0
mov eax, dword [ebp - 0x40]
push eax
call fcn.00451f70
add esp, 0xc
push 0x4bf504
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
mov word [ebp - 0xc8], cx
push 0x7e
push 0
lea edx, [ebp - 0xc6]
push edx
call fcn.00451f70
add esp, 0xc
mov al, byte [ebp - 0x14]
mov byte [ebp - 0xcd], al
lea ecx, [ebp - 0xcd]
push ecx
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.0047c280
test eax, eax
jne 0x47c614
jmp 0x47c761
movzx eax, byte [ebp - 0xcd]
push eax
push str.NVFLASH___index_d__b__A_MPCurr.rom
lea ecx, [ebp - 0xc8]
push ecx
call fcn.00452ec3
add esp, 0xc
lea edx, [ebp - 0xe4]
push edx
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0x8000020
push 0
push 0
push 0
lea ecx, [ebp - 0xc8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47c66a
jmp 0x47c761
mov edx, dword [ebp - 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x47c6f6
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x2e]
movzx ecx, word [ebp - 0xd4]
cmp eax, ecx
jge 0x47c6c6
movzx edx, word [ebp - 0x2e]
add edx, 0x3c
mov word [ebp - 0x2e], dx
movzx eax, word [ebp - 0x2e]
movzx ecx, word [ebp - 0xd4]
sub eax, ecx
cmp eax, 3
jle 0x47c6e9
push 0
mov edx, dword [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x47c6f6
cmp dword [ebp - 0x3c], 0x103
je 0x47c6f4
jmp 0x47c6f6
jmp 0x47c682
cmp dword [ebp - 0x3c], 0
je 0x47c700
jmp 0x47c761
push 0x4bf568
push str.MPCurr.rom
call fcn.00454db2
add esp, 8
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
je 0x47c727
cmp dword [ebp - 0x40], 0
jne 0x47c72b
jmp 0x47c761
mov eax, dword [ebp - 0xcc]
push eax
push 0x640
push 1
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00452797
add esp, 0x10
push 0x640
mov edx, dword [ebp - 0x40]
push edx
movzx eax, byte [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x168]
call fcn.004765f0
mov dword [ebp - 8], eax
cmp dword [ebp - 0xe4], 0
je 0x47c777
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x40], 0
je 0x47c795
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x164]
push eax
call fcn.0042c7f3
add esp, 4
cmp dword [ebp - 0xcc], 0
je 0x47c7ad
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.0045282b
add esp, 4
push 1
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.0040b090
movzx eax, al
test eax, eax
je 0x47ca1f
mov dword [ebp - 0x140], 1
lea ecx, [ebp - 0x140]
push ecx
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.00478c10
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jne 0x47c972
mov dword [ebp - 0x150], 0
push 0
lea eax, [ebp - 0x150]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.0047aa30
push 0x2d
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.0047a2a0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x14c], 0x28
mov byte [ebp - 0x14b], 0x29
mov byte [ebp - 0x143], 0xff
mov al, byte [ebp - 0x143]
mov byte [ebp - 0x144], al
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x154], 0
jmp 0x47c881
mov ecx, dword [ebp - 0x154]
add ecx, 1
mov dword [ebp - 0x154], ecx
cmp dword [ebp - 0x154], 5
jge 0x47c90f
push 1
push 1
lea edx, [ebp - 0x144]
push edx
push 1
lea eax, [ebp - 0x14c]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00477a50
test eax, eax
jne 0x47c90a
push 1
push 1
lea edx, [ebp - 0x143]
push edx
push 1
lea eax, [ebp - 0x14b]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00477a50
test eax, eax
jne 0x47c90a
movzx edx, byte [ebp - 0x144]
cmp edx, 0xff
je 0x47c90a
movzx eax, byte [ebp - 0x143]
cmp eax, 0xff
je 0x47c90a
mov ecx, dword [ebp - 0x148]
add ecx, 1
mov dword [ebp - 0x148], ecx
jmp 0x47c872
cmp dword [ebp - 0x148], 2
jl 0x47c93c
push 1
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x880
mov eax, dword [ebp - 0x168]
lea ecx, [eax + edx + 0x2bc]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.0040b040
cmp dword [ebp - 0x140], 1
jne 0x47c95b
push 0
push 0
movzx edx, byte [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x168]
call fcn.00479de0
jmp 0x47c972
mov eax, dword [ebp - 0x150]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.0047a2a0
mov byte [ebp - 0x131], 0
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x880
mov eax, dword [ebp - 0x168]
xor ecx, ecx
cmp dword [eax + edx + 0x2b4], 2
sete cl
add ecx, 0x38
mov byte [ebp - 0x139], cl
mov byte [ebp - 0x131], 0xff
push 1
push 1
lea edx, [ebp - 0x131]
push edx
push 1
lea eax, [ebp - 0x139]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00477900
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 1
lea edx, [ebp - 0x131]
push edx
push 1
lea eax, [ebp - 0x139]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x168]
call fcn.00477a50
test eax, eax
jne 0x47ca1f
movzx edx, byte [ebp - 0x131]
cmp edx, 0x7f
jle 0x47ca1f
movzx eax, byte [ebp - 0x131]
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x880
mov edx, dword [ebp - 0x168]
mov dword [edx + ecx + 0x64], eax
jmp 0x47c3d7
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.00451600
mov esp, ebp
pop ebp
ret