Function at 0x46116a
Capabilities:
Check for time delay via gettickcount
Create thread
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.004636d2
cmp byte [0x468a99], 0
mov dword [ebp - 0xc], 0xbb8
je 0x46119f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x468a9c], eax
je 0x4611a6
mov dword [ebp - 0xc], reloc.ADVAPI32.dll_TraceMessage
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
xor ebx, ebx
push ebx
call fcn.0045d352
test eax, eax
js 0x4613f0
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [ebp + 8]
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00460daa
test eax, eax
js 0x4613be
or edi, reloc.ADVAPI32.dll_TraceMessage
lea eax, [ebp - 0x20]
mov dword [ebp - 8], edi
call fcn.00463eba
push 2
pop esi
cmp eax, esi
jle 0x461220
mov eax, dword [ebp - 0x20]
push 0x3a
pop ecx
cmp cx, word [eax + 2]
jne 0x461220
movzx ecx, word [eax]
push 0x19
lea eax, [ecx - 0x61]
pop edx
cmp ax, dx
ja 0x461212
lea edi, [ecx - 0x61]
jmp 0x46121d
lea eax, [ecx - 0x41]
cmp ax, dx
ja 0x461220
lea edi, [ecx - 0x41]
mov dword [ebp - 8], edi
cmp byte [ebp + 0xc], bl
je 0x461387
test edi, edi
js 0x46123b
mov al, byte [edi + 0x4693a8]
test al, al
jne 0x461387
push 0x18
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
pop ecx
test edi, edi
je 0x461261
mov ecx, edi
call fcn.004636d2
or dword [edi + 0x14], 0xffffffff
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], esi
jmp 0x461263
mov edi, ebx
test edi, edi
je 0x4613be
lea eax, [ebp - 0x20]
call fcn.00464274
push eax
mov esi, edi
call fcn.004641f5
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push ebx
push edi
push 0x4610cc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x46134d
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x46130e
mov eax, dword [ebp - 8]
test eax, eax
js 0x4612c7
mov byte [eax + 0x4693a8], 1
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x467fd0]
cmp eax, 0x467fd0
je 0x46137e
test byte [eax + 0x44], 1
je 0x46137e
cmp byte [eax + 0x41], 2
jb 0x46137e
push dword [edi + 0x10]
mov ecx, dword [edi]
push EventRegister
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.00460b8a
jmp 0x46137e
mov eax, dword [0x467fd0]
cmp eax, 0x467fd0
je 0x461343
test byte [eax + 0x44], 1
je 0x461343
cmp byte [eax + 0x41], 2
jb 0x461343
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov eax, dword [0x467fd0]
push reloc.ADVAPI32.dll_EventRegister
push dword [eax + 0x3c]
mov ecx, esi
push dword [eax + 0x38]
call fcn.00460b8a
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46137e
mov esi, edi
call fcn.004610a5
mov eax, dword [0x467fd0]
cmp eax, 0x467fd0
je 0x46137e
test byte [eax + 0x44], 1
je 0x46137e
cmp byte [eax + 0x41], 2
jb 0x46137e
push 0x425250
push 0x10
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.00459c86
mov esi, edi
call fcn.004610a5
jmp 0x4613b4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [ebp - 0x20]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
call esi
test edi, edi
js 0x4613b4
sub eax, dword [ebp + 0xc]
cmp dword [ebp - 0xc], eax
sbb cl, cl
inc cl
mov byte [edi + 0x4693a8], cl
mov esi, dword [ebp - 4]
cmp esi, reloc.ADVAPI32.dll_TraceMessage
je 0x4613c1
jmp 0x4613d9
mov esi, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4613d9
and ebx, 0xffff
or ebx, 0x80070000
push ebx
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00460e0f
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x4613f3
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x20]
call fcn.00463afc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8