Function at 0x402fa0
Capabilities:
Check for time delay via gettickcount
Get file size
Read .ini file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x938
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
sub eax, dword [0x40bfb8]
cmp eax, 0x493e0
jbe 0x403007
push str.RAV.INI
push 0
push 0x40b440
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x40bfb4], eax
call esi
mov dword [0x40bfb8], eax
mov eax, dword [0x40bfb4]
test eax, 0x30000
je 0x403007
mov eax, dword [0x40bfb0]
test eax, eax
jne 0x403007
push 0
push str.DD_LOG_VIEW
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x40bfb0], eax
mov ecx, dword [0x40bfb4]
mov edx, dword [esp + 0x944]
mov eax, ecx
and eax, edx
test eax, 0xffff
je 0x4034bb
test ecx, 0xffff0000
je 0x40303e
test edx, 0xffff0000
je 0x40303e
test eax, 0xffff0000
je 0x4034bb
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x130]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x22]
lea edi, [esp + 0x138]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
and edx, 0xffff
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and edx, 0xffff
push eax
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x26]
and eax, 0xffff
and edx, 0xffff
push eax
mov eax, dword [esp + 0x26]
push edx
mov edx, dword [esp + 0x28]
and eax, 0xffff
and edx, 0xffff
not ecx
push eax
dec ecx
mov eax, 0x3ff
push edx
sub eax, ecx
push str.__4d__02d__02d___02d:_02d:_02d:_03d_
lea ecx, [esp + ecx + 0x158]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov edx, dword [esp + 0x978]
push 0x2d
push edx
call dword [sym.imp.MSVCRT.dll__mbschr]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsnbcat]
add esp, 0x30
test eax, eax
je 0x403119
sub eax, dword [esp + 0x950]
cmp eax, 0x14
jle 0x4031da
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, 0x4034d0
and esi, 0xffff0000
lea eax, [esp + 0x14]
push 0x1c
push eax
push esi
call ebx
test eax, eax
je 0x403166
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x34]
stosw word es:[edi], ax
push 0x104
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40316e
sub esi, 0x1000
jmp 0x40312a
lea eax, [esp + 0x34]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov edx, eax
add esp, 8
test edx, edx
jne 0x40318a
lea edx, [esp + 0x34]
jmp 0x40318b
inc edx
lea edi, [esp + 0x138]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x3ff
sub eax, ecx
lea ecx, [esp + 0x138]
push eax
push edx
push ecx
call ebp
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x3ff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x144]
sub edx, ecx
push edx
push str.___
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x954]
lea edi, [esp + 0x138]
push ecx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x954]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x3ff
sub eax, ecx
push edx
push eax
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esp + ecx + 0x144]
push ecx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov al, byte [0x40bbb0]
add esp, 0x10
test al, al
jne 0x4032b6
push str.RAV.INI
push 0x400
push 0x40bbb0
push 0x40ba58
push str.LOGNAME
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [0x40bbb0]
test al, al
jne 0x403297
push 0x400
push 0x40bbb0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x40bbb0
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x3ff
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
push edx
push str..log
push 0x40bbb0
call ebp
add esp, 0xc
push str.RAV.INI
push 0x400
push str.LOGSIZE
push str.DEBUG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x40b3e0], eax
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push 0x40bbb0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4033fd
cmp esi, 0xffffffff
je 0x4033fd
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [0x40b3e0]
shl eax, 0xa
cmp edi, eax
jbe 0x4033a7
push 0x400
call sub.MFC42.DLL_operatornew
mov ebx, edi
add esp, 4
shr edi, 0xa
shr ebx, 0xb
inc edi
mov ebp, eax
cmp ebx, edi
mov dword [esp + 0x30], edi
jae 0x403398
mov edi, ebx
shl edi, 0xa
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x400
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403398
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403398
push 0
lea edx, [edi - 0x7d000]
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403398
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403398
mov eax, dword [esp + 0x30]
inc ebx
add edi, 0x400
cmp ebx, eax
jb 0x40332b
test ebp, ebp
je 0x4033b4
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x4033b4
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edi, [esp + 0x138]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
not ecx
dec ecx
push edx
lea eax, [esp + 0x140]
push ecx
push eax
push esi
call edi
lea ecx, [esp + 0x10]
push 0
push ecx
push 2
push 0x40b3dc
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40bfb4]
pop ebp
test eax, 0x30000
pop ebx
je 0x4034bb
mov eax, dword [0x40bfb0]
test eax, eax
je 0x4034bb
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x530]
mov esi, 0x410
rep stosd dword es:[edi], eax
mov dword [esp + 0x530], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x534], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [esp + 0x944]
mov dword [esp + 0x538], eax
lea eax, [esp + 0x130]
push 0x400
lea ecx, [esp + 0x544]
push eax
push ecx
mov dword [esp + 0x548], edx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov eax, dword [0x40bfb0]
add esp, 0xc
lea edx, [esp + 0x530]
mov dword [esp + 0x10], esi
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4034bb
mov edx, dword [0x40bfb0]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
add esp, 0x938
ret