Function at 0x493d8c
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x493d94
push ecx
push ebx
push esi
push edi
mov eax, 0x493abc
call fcn.00406a48
mov ebx, dword [0x499104]
mov esi, dword [0x4990ac]
xor eax, eax
push ebp
push 0x494a91
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx]
mov eax, dword [0x498d60]
mov ecx, 0x494aa8
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x4990e8]
mov ecx, 0x494ac0
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498d6c]
mov ecx, 0x494ad4
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498fc4]
mov ecx, 0x494ae8
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498e34]
mov ecx, 0x494b00
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x4991f4]
mov ecx, 0x494b18
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498ec8]
mov ecx, 0x494b2c
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x49912c]
mov ecx, 0x494b44
call fcn.00403e5c
lea edx, [ebp - 0x14]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004086dc
mov edx, dword [ebp - 0x10]
mov eax, 0x49d200
call fcn.00403be4
push 0x104
mov eax, dword [0x498f38]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x493ee4
lea edx, [ebp - 0x18]
mov eax, dword [0x498f38]
call fcn.00409384
mov edx, dword [ebp - 0x18]
mov eax, dword [0x498de0]
call fcn.00403be4
mov eax, dword [0x498de0]
mov eax, dword [eax]
call fcn.00403e10
cmp eax, 3
jle 0x493ec6
mov eax, dword [0x498de0]
mov edx, 0x494b5c
call fcn.00403e18
mov eax, dword [0x498de0]
mov eax, dword [0x498de0]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x493ee4
mov eax, dword [0x498de0]
mov eax, dword [eax]
mov al, byte [eax]
mov edx, dword [0x498f30]
mov byte [edx], al
mov edx, dword [0x498de0]
mov edx, dword [edx]
mov eax, dword [0x498cd0]
mov ecx, 0x494b68
call fcn.00403e5c
mov eax, dword [0x498cd0]
mov eax, dword [eax]
call fcn.00408c98
test al, al
jne 0x493f3f
mov edx, dword [0x498de0]
mov edx, dword [edx]
mov eax, 0x49d374
mov ecx, 0x494b88
call fcn.00403e5c
push 0xffffffffffffffff
mov eax, dword [0x498cd0]
call fcn.00403fe0
push eax
mov eax, 0x49d374
call fcn.00403fe0
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [0x498de0]
mov edx, dword [edx]
mov eax, dword [0x4990b8]
mov ecx, 0x494ba4
call fcn.00403e5c
mov eax, dword [0x4990b8]
mov eax, dword [eax]
call fcn.00408c98
test al, al
jne 0x493f9a
mov edx, dword [0x498de0]
mov edx, dword [edx]
mov eax, 0x49d374
mov ecx, 0x494bc4
call fcn.00403e5c
push 0xffffffffffffffff
mov eax, dword [0x4990b8]
call fcn.00403fe0
push eax
mov eax, 0x49d374
call fcn.00403fe0
push eax
call sub.kernel32.dll_CopyFileA
push 0x104
mov eax, dword [0x498f38]
push eax
push 0x494bdc
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x498f38]
call fcn.00409364
lea ecx, [ebp - 0x1c]
mov edx, 0x494bec
mov eax, 0x494c00
call fcn.004712c4
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00403be4
cmp dword [esi], 0
je 0x493fe5
mov eax, dword [esi]
call fcn.004494c4
test al, al
jne 0x49400f
mov eax, esi
mov edx, dword [0x498f38]
mov ecx, 0x105
call fcn.00403dc0
mov eax, esi
call fcn.00450bfc
mov eax, 0x494c00
mov ecx, dword [esi]
mov edx, 0x494bec
call fcn.004710a0
mov edx, dword [esi]
mov eax, dword [0x4991e8]
mov ecx, 0x494c38
call fcn.00403e5c
mov edx, dword [esi]
mov eax, dword [0x498df4]
mov ecx, 0x494c4c
call fcn.00403e5c
mov eax, dword [0x49d200]
cmp byte [eax], 0x5c
jne 0x494045
mov eax, dword [0x499128]
mov byte [eax], 2
jmp 0x494071
lea eax, [ebp - 0x20]
mov edx, dword [0x498f38]
mov ecx, 0x105
call fcn.00403dc0
mov eax, dword [ebp - 0x20]
mov edx, dword [0x49d200]
call fcn.004040fc
dec eax
jne 0x494071
mov eax, dword [0x499128]
mov byte [eax], 1
lea edx, [ebp - 0x28]
mov eax, 1
call fcn.00402960
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408718
mov edx, dword [ebp - 0x24]
mov eax, 0x49d208
call fcn.00403be4
lea edx, [ebp - 0x30]
mov eax, 2
call fcn.00402960
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408718
mov edx, dword [ebp - 0x2c]
mov eax, 0x49d20c
call fcn.00403be4
lea eax, [ebp - 0x34]
call fcn.004724cc
mov edx, dword [ebp - 0x34]
mov eax, 0x49d370
call fcn.00403be4
mov eax, dword [0x49d370]
mov edx, 0x494c60
call fcn.00403f20
jne 0x4940f6
mov eax, dword [0x498f40]
mov byte [eax], 0
mov eax, dword [0x49918c]
mov byte [eax], 1
jmp 0x49427d
mov eax, dword [0x49d208]
mov edx, 0x494c70
call fcn.00403f20
jne 0x494176
mov eax, 0x494c74
xor edx, edx
call fcn.00472270
mov edi, eax
test edi, edi
je 0x49413d
mov eax, 0x3e8
call fcn.004721cc
mov eax, dword [0x498ea8]
mov eax, dword [eax]
push eax
push 1
push 0x600
push edi
call sub.user32.dll_PostMessageA
jmp 0x494a76
mov eax, 0x3e8
call fcn.004721cc
inc dword [0x498cc0]
cmp dword [0x498cc0], 5
jne 0x494167
push 0
push 0x494c84
call sub.kernel32.dll_WinExec
jmp 0x49427d
cmp dword [0x498cc0], 0x64
jae 0x494a76
jmp 0x494107
mov eax, dword [0x49d208]
mov edx, 0x494cac
call fcn.00403f20
jne 0x49418f
mov eax, dword [0x498f40]
mov byte [eax], 1
mov eax, 0x494c00
lea ecx, [ebp - 0x38]
mov edx, 0x494cb8
call fcn.004712c4
mov edx, dword [ebp - 0x38]
mov eax, 0x49d368
call fcn.00403be4
mov eax, 0x494c00
lea ecx, [ebp - 0x3c]
mov edx, 0x494ccc
call fcn.004712c4
mov edx, dword [ebp - 0x3c]
mov eax, 0x49d36c
call fcn.00403be4
mov eax, dword [0x49d368]
call fcn.00403fd4
push eax
mov eax, dword [0x49d370]
call fcn.00403fd4
pop edx
call fcn.00409268
test eax, eax
sete byte [0x49d378]
cmp dword [0x49d368], 0
je 0x49425e
cmp byte [0x49d378], 0
jne 0x49427d
push dword [0x49d208]
push 0x494ce0
push dword [0x49d20c]
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.00403ed0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [0x49d200]
mov edx, dword [0x49d36c]
mov eax, dword [0x49d368]
call fcn.00493804
test al, al
jne 0x494a76
inc dword [0x498cc0]
mov eax, 0x3e8
call fcn.004721cc
cmp dword [0x498cc0], 5
jb 0x494203
jmp 0x49427d
mov eax, 0x494c00
lea ecx, [ebp - 0x44]
mov edx, 0x494cec
call fcn.004712c4
mov edx, dword [ebp - 0x44]
mov eax, dword [0x498f34]
call fcn.00403be4
mov eax, dword [0x49d208]
mov edx, 0x494d00
call fcn.00403f20
je 0x4942a3
mov eax, dword [0x49d20c]
mov edx, 0x494d00
call fcn.00403f20
je 0x4942a3
xor eax, eax
jmp 0x4942a5
mov al, 1
test al, al
je 0x4942d1
mov eax, 0x7d0
call fcn.004721cc
mov eax, dword [0x498ec8]
mov eax, dword [eax]
call fcn.00408c98
test al, al
je 0x4942e5
mov eax, dword [0x498ec8]
mov eax, dword [eax]
call fcn.00408e1c
jmp 0x4942e5
mov eax, dword [0x498f40]
cmp byte [eax], 1
jne 0x4942e5
mov eax, 0x7d0
call fcn.004721cc
mov eax, 0x494c00
mov edx, 0x494d0c
call fcn.004716f8
sub eax, 0x7d0
mov dword [0x498cc8], eax
mov eax, 0x494c00
mov edx, 0x494d24
call fcn.00471f80
test al, al
je 0x49432a
mov eax, 0x494c00
mov edx, 0x494d24
call fcn.004716f8
mov edx, dword [0x498ea8]
mov dword [edx], eax
jmp 0x494335
mov eax, dword [0x498ea8]
mov dword [eax], 0x1f40
mov dl, 1
mov eax, dword [0x449604]
call fcn.00402e54
mov esi, eax
mov edx, 0x494d3c
mov eax, esi
call fcn.00449690
test eax, eax
jne 0x4943f0
mov eax, dword [0x498f40]
cmp byte [eax], 0
je 0x494a6f
mov eax, 0x494c74
xor edx, edx
call fcn.00472270
mov edi, eax
test edi, edi
je 0x494a6f
mov eax, 0x3e8
call fcn.004721cc
mov eax, dword [0x49d208]
mov edx, 0x494d54
call fcn.00403f20
jne 0x4943aa
push 0
push 0
push 0x702
push edi
call sub.user32.dll_PostMessageA
jmp 0x494a6f
mov eax, dword [0x49d208]
mov edx, 0x494d60
call fcn.00403f20
jne 0x4943cf
push 0
push 0
push 0x604
push edi
call sub.user32.dll_PostMessageA
jmp 0x494a6f
mov eax, dword [0x498ea8]
mov eax, dword [eax]
push eax
mov eax, dword [0x498f40]
movzx eax, byte [eax]
push eax
push 0x600
push edi
call sub.user32.dll_PostMessageA
jmp 0x494a6f
mov eax, dword [0x499128]
cmp byte [eax], 1
je 0x494515
mov eax, 0x494c00
lea ecx, [ebp - 0x48]
mov edx, 0x494d6c
call fcn.004712c4
mov edx, dword [ebp - 0x48]
mov eax, 0x49d1fc
call fcn.00403be4
lea ecx, [ebp - 0x4c]
mov edx, 0x494d80
mov eax, 0x494d94
call fcn.004712c4
mov edx, dword [ebp - 0x4c]
mov eax, 0x49d1f0
call fcn.00403be4
push 0x494de0
lea edx, [ebp - 0x50]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
push dword [ebp - 0x50]
push 0x494dec
mov eax, 0x49d1f8
mov edx, 3
call fcn.00403ed0
mov eax, dword [0x498f40]
cmp byte [eax], 0
jne 0x494483
mov eax, 0x49d1f4
mov edx, dword [0x49d1f8]
call fcn.00403be4
jmp 0x4944ae
push 0x494de0
lea edx, [ebp - 0x54]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
push dword [ebp - 0x54]
push 0x494dfc
mov eax, 0x49d1f4
mov edx, 3
call fcn.00403ed0
mov eax, dword [0x49d1fc]
mov edx, 0x494e0c
call fcn.00403f20
jne 0x4944ec
cmp dword [0x49d1f0], 0
je 0x494515
mov eax, dword [0x49d1f0]
mov edx, dword [0x49d1f4]
call fcn.00403f20
je 0x494515
mov eax, dword [0x49d1f0]
mov edx, dword [0x49d1f8]
call fcn.00403f20
je 0x494515
mov eax, 0x494c00
mov ecx, 0x494e0c
mov edx, 0x494d6c
call fcn.004710a0
mov eax, 0x494d94
mov edx, 0x494d80
mov ecx, dword [0x49d1f4]
call fcn.004710a0
mov eax, 0x494c00
mov edx, 0x494e18
call fcn.004716f8
mov edi, eax
cmp edi, 0x96ee
je 0x49455e
mov eax, 0x494c00
mov ecx, 0x96ee
mov edx, 0x494e18
call fcn.004714dc
test edi, edi
jne 0x49455e
mov eax, 0x494c00
mov edx, 0x494e2c
call fcn.0047191c
mov eax, dword [0x498f90]
xor edx, edx
mov dword [eax], edx
mov edx, dword [ebx]
mov eax, dword [0x499064]
mov ecx, 0x494e40
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498dbc]
mov ecx, 0x494e54
call fcn.00403e5c
mov edx, dword [ebx]
mov eax, dword [0x498fec]
mov ecx, 0x494e68
call fcn.00403e5c
mov eax, dword [0x499128]
cmp byte [eax], 2
jne 0x494765
mov eax, dword [0x498f40]
cmp byte [eax], 0
je 0x494765
lea edx, [ebp - 0x58]
mov eax, dword [0x498f38]
call fcn.00409384
mov edx, dword [ebp - 0x58]
mov eax, 0x49d35c
mov ecx, 0x494e7c
call fcn.00403e5c
mov edx, dword [0x499064]
mov edx, dword [edx]
mov eax, dword [0x49d35c]
call fcn.004934bc
lea edx, [ebp - 0x5c]
mov eax, dword [0x498f38]
call fcn.00409384
mov edx, dword [ebp - 0x5c]
mov eax, 0x49d35c
mov ecx, 0x494e94
call fcn.00403e5c
mov edx, dword [0x498fec]
mov edx, dword [edx]
mov eax, dword [0x49d35c]
call fcn.004934bc
mov edx, dword [ebx]
mov eax, 0x49d360
mov ecx, 0x494aa8
call fcn.00403e5c
lea edx, [ebp - 0x60]
mov eax, dword [0x498f38]
call fcn.00409384
push dword [ebp - 0x60]
push 0x494b5c
push 0x494aa8
mov eax, 0x49d364
mov edx, 3
call fcn.00403ed0
mov edx, dword [0x49d360]
mov eax, dword [0x49d364]
call fcn.004934bc
mov ecx, 0x494ae8
mov edx, dword [ebx]
mov eax, 0x49d360
call fcn.00403e5c
lea edx, [ebp - 0x64]
mov eax, dword [0x498f38]
call fcn.00409384
push dword [ebp - 0x64]
push 0x494b5c
push 0x494ae8
mov eax, 0x49d364
mov edx, 3
call fcn.00403ed0
mov edx, dword [0x49d360]
mov eax, dword [0x49d364]
call fcn.004934bc
mov edx, dword [ebx]
mov eax, 0x49d360
mov ecx, 0x494ac0
call fcn.00403e5c
lea edx, [ebp - 0x68]
mov eax, dword [0x498f38]
call fcn.00409384
push dword [ebp - 0x68]
push 0x494b5c
push 0x494ac0
mov eax, 0x49d364
mov edx, 3
call fcn.00403ed0
mov edx, dword [0x49d360]
mov eax, dword [0x49d364]
call fcn.004934bc
lea eax, [ebp - 0x70]
mov edx, dword [0x498f38]
mov ecx, 0x105
call fcn.00403dc0
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00493a08
mov edx, dword [ebp - 0x6c]
mov eax, 0x49d204
mov ecx, 0x494eac
call fcn.00403e5c
push 0
mov eax, dword [0x49d204]
call fcn.00403fd4
mov ebx, eax
push ebx
mov eax, dword [0x49d200]
call fcn.00403fd4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x494765
push 1
mov eax, dword [0x498f38]
push eax
mov eax, dword [0x49d208]
call fcn.00403fd4
push eax
push ebx
push 0x494ebc
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x494a6f
mov eax, dword [0x498f40]
cmp byte [eax], 1
jne 0x4948ae
mov eax, dword [0x499128]
cmp byte [eax], 0
jne 0x4948ae
mov eax, 0x494c00
lea ecx, [ebp - 0x74]
mov edx, 0x494ecc
call fcn.004712c4
mov edx, dword [ebp - 0x74]
mov eax, 0x49d1ec
call fcn.00403be4
cmp dword [0x49d1ec], 0
je 0x4948ae
mov eax, dword [0x49d1ec]
call fcn.004494c4
test al, al
jne 0x4947cf
mov eax, 0x494c00
mov edx, 0x494ee0
call fcn.004716f8
call fcn.004721cc
mov eax, dword [0x49d1ec]
call fcn.004494c4
test al, al
je 0x4948ae
call fcn.00493570
test al, al
je 0x4948ae
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov eax, 0x494c00
mov edx, 0x494ef4
call fcn.004714dc
lea edx, [ebp - 0x78]
xor eax, eax
call fcn.00484f34
mov edx, dword [ebp - 0x78]
mov eax, dword [0x4991a8]
call fcn.00403be4
mov edx, dword [0x4991a8]
mov edx, dword [edx]
mov eax, 0x49d210
call fcn.00405ea6
mov edx, 0x80
mov eax, 0x49d210
call fcn.004060ec
call sub.kernel32.dll_GetTickCount
mov ebx, eax
add ebx, 0x7d0
jmp 0x494865
mov eax, 0x494c00
mov edx, 0x494ef4
call fcn.004716f8
test eax, eax
je 0x49486e
push 0x64
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
ja 0x49484b
mov eax, 0x49d210
call fcn.00405f48
mov eax, dword [0x4991a8]
mov eax, dword [eax]
call fcn.00408e1c
push 1
mov edx, dword [0x498ec8]
mov edx, dword [edx]
lea eax, [ebp - 0x7c]
mov ecx, 0x494f08
call fcn.00403e5c
mov eax, dword [ebp - 0x7c]
call fcn.00403fd4
push eax
call sub.kernel32.dll_WinExec
jmp 0x494a6f
mov eax, dword [0x498f40]
cmp byte [eax], 1
je 0x4948c1
mov eax, dword [0x498ea8]
xor edx, edx
mov dword [eax], edx
cmp dword [0x498cc8], 0
jle 0x49490e
mov eax, dword [0x498f40]
mov al, byte [eax]
sub al, 2
jae 0x49490e
mov eax, dword [0x498cc8]
call fcn.004721cc
mov eax, dword [0x498ea8]
cmp dword [eax], 0
jle 0x49490e
mov eax, dword [0x498ea8]
mov edx, dword [0x498cc8]
sub dword [eax], edx
mov eax, dword [0x498ea8]
cmp dword [eax], 0x7d0
jge 0x49490e
mov eax, dword [0x498ea8]
mov dword [eax], 0x7d0
push 0x20
mov ecx, dword [0x49d200]
mov dl, 1
mov eax, dword [0x40deac]
call fcn.00410c64
mov ebx, eax
mov eax, dword [0x498fc4]
mov eax, dword [eax]
call fcn.00408c98
test al, al
je 0x494952
push 0x20
mov ecx, dword [0x498fc4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x40deac]
call fcn.00410c64
mov edx, dword [0x498ce0]
mov dword [edx], eax
mov eax, dword [0x498e34]
mov eax, dword [eax]
call fcn.00408c98
test al, al
je 0x494980
push 0x20
mov ecx, dword [0x498e34]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x40deac]
call fcn.00410c64
mov edx, dword [0x498e18]
mov dword [edx], eax
mov eax, dword [0x499190]
cmp dword [eax], 0
je 0x4949a5
push 0x20
mov ecx, dword [0x499190]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x40deac]
call fcn.00410c64
mov dword [0x498cc4], eax
call fcn.004029b8
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042e940
call fcn.0048662c
mov ecx, dword [0x4990fc]
mov eax, dword [0x49904c]
mov eax, dword [eax]
mov edx, dword [0x4847cc]
call fcn.0042e958
mov ecx, dword [0x499070]
mov eax, dword [0x49904c]
mov eax, dword [eax]
mov edx, dword [0x487fe0]
call fcn.0042e958
mov ecx, dword [0x498e50]
mov eax, dword [0x49904c]
mov eax, dword [eax]
mov edx, dword [0x4867c8]
call fcn.0042e958
mov eax, dword [0x499070]
mov eax, dword [eax]
mov edx, dword [0x4990fc]
mov edx, dword [edx]
mov dword [edx + 0x2f4], eax
call fcn.004866c8
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042e9d8
mov eax, ebx
call fcn.00402e84
mov eax, dword [0x498ce0]
cmp dword [eax], 0
je 0x494a46
mov eax, dword [0x498ce0]
mov eax, dword [eax]
call fcn.00402e84
mov eax, dword [0x498e18]
cmp dword [eax], 0
je 0x494a5c
mov eax, dword [0x498e18]
mov eax, dword [eax]
call fcn.00402e84
cmp dword [0x498cc4], 0
je 0x494a6f
mov eax, dword [0x498cc4]
call fcn.00402e84
mov eax, esi
call fcn.00402e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494a98
lea eax, [ebp - 0x7c]
mov edx, 0x1c
call fcn.00403bb4
ret