Function at 0x480c79
Capabilities:
Check for time delay via gettickcount
Delete file
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
sub esp, 0xa4c
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0xa4c], eax
push 0x58
mov eax, 0x764932
call fcn.0048d201
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x410], ax
xor esi, esi
lea eax, [ebp + 0x412]
push esi
push eax
mov ebx, ecx
call fcn.0048d310
xor eax, eax
push edi
mov word [ebp + 0x820], ax
lea eax, [ebp + 0x822]
push esi
push eax
call fcn.0048d310
xor eax, eax
push edi
mov word [ebp + 0x618], ax
lea eax, [ebp + 0x61a]
push esi
push eax
call fcn.0048d310
add esp, 0x24
push 8
xor eax, eax
pop ecx
lea edi, [ebp + 0xa29]
mov byte [ebp + 0xa28], 0
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x480d28
cmp dword [ebp + 0xa5c], esi
je 0x480d17
push esi
jmp 0x480d19
push 3
push 1
call eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov edi, 0x208
push edi
lea eax, [ebp + 0x618]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x820]
push edi
push eax
call fcn.004718bc
mov eax, dword [ebx + 0x54]
add eax, 0x124
push eax
lea eax, [ebp + 0x820]
push eax
push 0x78bd6c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0xa28]
push eax
lea eax, [ebp + 0x820]
push eax
call fcn.0047199f
mov eax, dword [ebx + 0x54]
lea ecx, [eax + 0x1b0]
add esp, 0x20
lea eax, [ebp + 0xa28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x480da8
test dl, dl
je 0x480da4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x480da8
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x480d8a
xor eax, eax
jmp 0x480dad
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x480f72
mov eax, dword [ebx + 0x54]
cmp dword [eax + 0x1d8], esi
jne 0x480e07
push edi
lea eax, [ebp + 0x820]
push esi
push eax
call fcn.0048d310
lea eax, [ebp + 0x820]
push edi
push eax
call fcn.004718a8
mov eax, dword [ebx + 0x54]
add eax, 0x124
push eax
lea eax, [ebp + 0x820]
push eax
push 0x78bd78
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp + 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 0x1a8]
push eax
mov dword [ebp - 0x10], eax
call fcn.00481e79
push dword [ebp - 0x10]
mov edi, eax
push esi
push edi
call fcn.0048d310
push 0x789bb4
lea eax, [ebp + 0x618]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0048f5eb
push 2
push esi
push dword [ebp - 0x18]
call fcn.0048f489
push dword [ebp - 0x18]
call fcn.0048f391
sub eax, dword [ebp - 0x10]
push esi
push eax
push dword [ebp - 0x18]
call fcn.0048f489
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 1
push edi
call fcn.0048f1d7
add esp, 0x48
push dword [ebp - 0x18]
call fcn.0048eebb
xor eax, eax
pop ecx
cmp dword [ebp - 0x10], esi
jbe 0x480e88
xor byte [eax + edi], 0x18
inc eax
cmp eax, dword [ebp - 0x10]
jb 0x480e7e
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x1c], 0x80
cmp dword [eax + 0x1d4], esi
je 0x480ea1
mov dword [ebp - 0x1c], 0x82
xor eax, eax
push 0x206
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push esi
push eax
call fcn.0048d310
lea eax, [ebp + 0x820]
push eax
lea eax, [ebp + 0x208]
push str._s.tmp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp + 0x820]
push eax
call fcn.004914f5
pop ecx
pop ecx
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push dword [ebp - 0x1c]
lea eax, [ebp + 0x820]
push 2
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x480f43
push esi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00481e6e
push 8
xor eax, eax
pop ecx
lea edi, [ebp + 0xa28]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp + 0xa28]
push eax
lea eax, [ebp + 0x820]
push eax
call fcn.0047199f
add esp, 0xc
mov edi, 0x208
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
mov ecx, 0xbb8
cmp eax, ecx
jae 0x480f8d
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x820]
push eax
lea ecx, [ebx + 0x64]
call fcn.0044cd2c
lea eax, [ebp + 0x820]
push eax
lea eax, [ebp + 0x410]
push 0x80b2a8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x410]
push edi
push eax
call fcn.00471aea
mov eax, dword [ebx + 0x54]
add esp, 0x14
cmp dword [eax + 0x2b0], esi
je 0x48103d
lea eax, [ebx + 0xa4]
push eax
lea eax, [ebp + 0x820]
push esi
push eax
call fcn.00471a75
lea eax, [ebp + 0x618]
push eax
lea eax, [ebp + 0x410]
push eax
push ebx
lea eax, [ebp - 0x64]
push 0x480aea
push eax
call fcn.0047fe79
add esp, 0x20
push esi
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
call fcn.00480c3c
and dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0xb4]
call fcn.0047fd85
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004499ff
xor esi, esi
mov edi, 0x208
jmp 0x48104a
lea eax, [ebp + 0x820]
push eax
call fcn.00471a37
pop ecx
cmp dword [ebx + 0x5c], esi
jne 0x481101
cmp dword [ebp + 0xa58], esi
je 0x481101
cmp dword [ebp + 0xa5c], esi
je 0x481070
push 2
push 1
call dword [ebx + 0x58]
pop ecx
pop ecx
mov eax, dword [ebx + 0x54]
cmp dword [eax + 0x2a8], esi
je 0x48110a
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.0048d310
mov eax, dword [ebx + 0x54]
add eax, 0x124
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp]
push edi
push eax
call fcn.00471c29
add esp, 0x1c
lea eax, [ebp + 0x618]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044d9a5
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp]
inc edi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], edi
call fcn.0044d9a5
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.0047ff2e
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x54]
call fcn.00449c25
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x38]
call fcn.00449c25
jmp 0x48110a
push 1
push 1
call dword [ebx + 0x58]
pop ecx
pop ecx
lea eax, [ebp + 0x618]
push eax
lea eax, [ebp + 0x410]
push eax
mov ecx, ebx
call fcn.0047fab7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa4c]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0xa50
leave
ret 8