Function at 0x49d9ac
Capabilities:
Check for time delay via gettickcount
Create process on windows
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49d9b4
push ecx
push ebx
push esi
push edi
mov ebx, 0x4a5fd8
mov esi, 0x4a5fcc
mov edi, 0x4a5fc8
xor eax, eax
push ebp
push 0x49e6a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40
call fcn.00496afc
mov dword [0x4a5e74], 1
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [0x4a5fdc], eax
mov dword [0x4a5fe0], edx
mov eax, 0x49e6c0
call fcn.0040be4c
fstp qword [ebp - 8]
wait
call fcn.0040a980
fadd qword [ebp - 8]
fstp qword [0x4a5e64]
wait
mov eax, ebx
call fcn.00499790
mov eax, dword [ebx]
call fcn.00497bec
test al, al
je 0x49da4e
mov eax, dword [ebx]
call fcn.0040be4c
fstp qword [ebp - 8]
wait
call fcn.0040a980
fadd qword [ebp - 8]
fstp qword [0x4a5e6c]
wait
jmp 0x49da5f
mov eax, 0x49e6d4
call fcn.0040be4c
fstp qword [0x4a5e6c]
wait
xor eax, eax
mov dword [0x4a5e78], eax
mov dl, 1
mov eax, dword [0x416a7c]
call fcn.004038bc
mov edx, dword [0x4a37cc]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x416a7c]
call fcn.004038bc
mov edx, dword [0x4a3810]
mov dword [edx], eax
call fcn.00497560
call fcn.0049d5ac
call fcn.0049c484
mov dword [0x4a5fec], eax
push 0x1f4
call sub.kernel32.dll_Sleep
cmp dword [0x4a5fec], 0
je 0x49e669
call fcn.0049d5ac
call fcn.0049c4ec
call fcn.0049d750
push 0x64
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.00499ef4
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49daee
mov dword [0x4a5e74], 1
cmp dword [0x4a5e74], 1
jne 0x49dafc
call fcn.0049d2e8
mov eax, ebx
call fcn.00499880
mov eax, dword [ebx]
mov edx, 0x49e6f8
call fcn.00404b3c
jne 0x49dd02
mov eax, ebx
call fcn.00496c70
mov eax, edi
call fcn.00497ca0
mov eax, dword [edi]
mov edx, dword [ebx]
call fcn.00404b3c
jne 0x49dd02
mov eax, ebx
call fcn.0049bbf4
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [0x4a5fe4], eax
mov dword [0x4a5fe8], edx
mov eax, dword [ebx]
call fcn.00408ea4
cdq
push edx
push eax
mov eax, dword [0x4a5fe4]
mov edx, dword [0x4a5fe8]
sub eax, dword [0x4a5fdc]
sbb edx, dword [0x4a5fe0]
cmp edx, dword [esp + 4]
jne 0x49db7d
cmp eax, dword [esp]
pop edx
pop eax
jb 0x49db94
jmp 0x49db81
pop edx
pop eax
jl 0x49db94
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [0x4a5fdc], eax
mov dword [0x4a5fe0], edx
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, edi
call fcn.00497794
mov eax, esi
mov edx, 0x49e714
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.00404730
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49dbe5
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49dbe5
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
push 0x64
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.00498c54
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49dc06
call fcn.0049c134
mov eax, ebx
call fcn.00498b58
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49dc20
call fcn.0049c0a8
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, esi
call fcn.00497e38
lea edx, [ebp - 0xc]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.0049811c
cmp dword [esi], 0
je 0x49dd02
mov eax, dword [esi]
mov edx, 0x49e73c
call fcn.00404b3c
je 0x49dd02
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49dd02
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49dd02
mov eax, ebx
call fcn.00498864
mov eax, esi
call fcn.00497e38
lea edx, [ebp - 0x10]
mov eax, dword [esi]
call fcn.004093f0
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404784
lea edx, [ebp - 0x14]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e748
call fcn.00404b3c
jne 0x49dcdc
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
mov eax, dword [ebx]
mov edx, 0x49e758
call fcn.00404b3c
jne 0x49dcef
call fcn.00497328
mov eax, dword [ebx]
mov edx, 0x49e768
call fcn.00404b3c
jne 0x49dd02
call fcn.004973e4
mov eax, ebx
call fcn.00499ff0
mov eax, dword [ebx]
mov edx, 0x49e77c
call fcn.00404b3c
je 0x49e3ef
push 0x64
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.0049bbf4
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [0x4a5fe4], eax
mov dword [0x4a5fe8], edx
mov eax, dword [ebx]
call fcn.00408ea4
cdq
push edx
push eax
mov eax, dword [0x4a5fe4]
mov edx, dword [0x4a5fe8]
sub eax, dword [0x4a5fdc]
sbb edx, dword [0x4a5fe0]
cmp edx, dword [esp + 4]
jne 0x49dd71
cmp eax, dword [esp]
pop edx
pop eax
jb 0x49df8a
jmp 0x49dd79
pop edx
pop eax
jl 0x49df8a
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [0x4a5fdc], eax
mov dword [0x4a5fe0], edx
mov eax, edi
call fcn.0049becc
mov eax, dword [edi]
mov edx, 0x49e78c
call fcn.00404b3c
jne 0x49de8b
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, edi
call fcn.00498614
mov eax, esi
call fcn.0049bdd8
mov eax, 0x4a5fd0
call fcn.0049bce4
cmp dword [edi], 0
je 0x49de8b
mov eax, dword [edi]
call fcn.00499a68
test al, al
jne 0x49de8b
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49de8b
mov eax, 0x4a5ff0
xor ecx, ecx
mov edx, 0x44
call fcn.0040311c
mov dword [0x4a5ff0], 0x44
mov dword [0x4a601c], 1
mov word [0x4a6020], 0
push dword [0x4a5fd0]
push 0x49e79c
push dword [edi]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404ab0
mov eax, dword [ebp - 0x18]
call fcn.00404bf0
push eax
push 0x4a6044
call sub.kernel32.dll_lstrcpyA
push 0x4a6034
push 0x4a5ff0
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x4a6044
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x49de8b
mov eax, dword [0x4a6038]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4a6034]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
call fcn.0049becc
mov eax, dword [edi]
mov edx, 0x49e7a8
call fcn.00404b3c
jne 0x49df8a
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, edi
call fcn.00498614
mov eax, esi
call fcn.0049bdd8
mov eax, 0x4a5fd0
call fcn.0049bce4
cmp dword [edi], 0
je 0x49df8a
mov eax, dword [edi]
call fcn.00499a68
test al, al
jne 0x49df8a
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49df8a
mov eax, 0x4a5ff0
xor ecx, ecx
mov edx, 0x44
call fcn.0040311c
mov dword [0x4a5ff0], 0x44
mov dword [0x4a601c], 1
mov word [0x4a6020], 1
push dword [0x4a5fd0]
push 0x49e79c
push dword [edi]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404ab0
mov eax, dword [ebp - 0x1c]
call fcn.00404bf0
push eax
push 0x4a6044
call sub.kernel32.dll_lstrcpyA
push 0x4a6034
push 0x4a5ff0
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x4a6044
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x49df8a
mov eax, dword [0x4a6038]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4a6034]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.00499ff0
mov eax, dword [ebx]
mov edx, 0x49e7b8
call fcn.00404b3c
je 0x49e034
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, 0x4a5fd0
call fcn.00497794
mov eax, edi
mov edx, 0x49e7c4
call fcn.00404784
mov eax, esi
call fcn.00404730
mov eax, ebx
call fcn.0049bfbc
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49dfe4
call fcn.004976d8
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e034
mov eax, dword [edi]
call fcn.00499a68
test al, al
jne 0x49e034
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e034
push 0
mov eax, dword [0x4a5fd0]
call fcn.00404bf0
push eax
mov eax, dword [esi]
call fcn.00404bf0
push eax
mov eax, dword [edi]
call fcn.00404bf0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.0049c484
mov dword [0x4a5fec], eax
cmp dword [0x4a5fec], 0
je 0x49e3e2
push 0x12c
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.00496c70
mov eax, edi
call fcn.00497ca0
mov eax, dword [edi]
mov edx, dword [ebx]
call fcn.00404b3c
je 0x49e07d
call fcn.0049bbc8
call fcn.0049bba0
call fcn.00497120
mov eax, ebx
call fcn.00496c70
mov eax, edi
call fcn.00497ca0
mov eax, dword [ebx]
mov edx, dword [edi]
call fcn.00404b3c
jne 0x49e3e2
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, edi
call fcn.00497794
mov eax, esi
mov edx, 0x49e714
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.00404730
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49e0eb
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e0eb
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
push 0x64
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.00498c54
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49e10c
call fcn.0049c134
mov eax, ebx
call fcn.00498b58
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49e126
call fcn.0049c0a8
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, esi
call fcn.00497e38
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.0049811c
cmp dword [esi], 0
je 0x49e208
mov eax, dword [esi]
mov edx, 0x49e73c
call fcn.00404b3c
je 0x49e208
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49e208
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e208
mov eax, ebx
call fcn.00498864
mov eax, esi
call fcn.00497e38
lea edx, [ebp - 0x24]
mov eax, dword [esi]
call fcn.004093f0
mov edx, dword [ebp - 0x24]
mov eax, edi
call fcn.00404784
lea edx, [ebp - 0x28]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e748
call fcn.00404b3c
jne 0x49e1e2
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
mov eax, dword [ebx]
mov edx, 0x49e758
call fcn.00404b3c
jne 0x49e1f5
call fcn.00497328
mov eax, dword [ebx]
mov edx, 0x49e768
call fcn.00404b3c
jne 0x49e208
call fcn.004973e4
mov eax, ebx
call fcn.00499ff0
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49e229
mov eax, ebx
mov edx, 0x49e7d8
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e7b8
call fcn.00404b3c
jne 0x49e243
mov eax, ebx
mov edx, 0x49e7d8
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e7d8
call fcn.00404b3c
jne 0x49e3e2
mov eax, ebx
call fcn.004994bc
mov eax, dword [ebx]
mov edx, 0x49e7e8
call fcn.00404b3c
jne 0x49e26f
call fcn.0049c608
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e282
call fcn.0049cb60
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, esi
call fcn.00497f2c
lea edx, [ebp - 0x2c]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.0049821c
mov eax, ebx
call fcn.00498960
cmp dword [esi], 0
je 0x49e332
mov eax, dword [esi]
mov edx, 0x49e73c
call fcn.00404b3c
je 0x49e332
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49e332
mov eax, dword [ebx]
mov edx, 0x49e748
call fcn.00404b3c
jne 0x49e332
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e332
mov eax, esi
call fcn.00497f2c
lea edx, [ebp - 0x30]
mov eax, dword [esi]
call fcn.004093f0
mov edx, dword [ebp - 0x30]
mov eax, edi
call fcn.00404784
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.00404784
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, esi
call fcn.00498024
lea edx, [ebp - 0x38]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x38]
mov eax, esi
call fcn.00404784
mov eax, 0x4a5fd0
call fcn.0049831c
mov eax, ebx
call fcn.00498a5c
cmp dword [esi], 0
je 0x49e3e2
mov eax, dword [esi]
mov edx, 0x49e73c
call fcn.00404b3c
je 0x49e3e2
mov eax, dword [esi]
call fcn.00499a68
test al, al
jne 0x49e3e2
mov eax, dword [ebx]
mov edx, 0x49e748
call fcn.00404b3c
jne 0x49e3e2
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e3e2
mov eax, esi
call fcn.00498024
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.004093f0
mov edx, dword [ebp - 0x3c]
mov eax, edi
call fcn.00404784
lea edx, [ebp - 0x40]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x40]
mov eax, esi
call fcn.00404784
mov ecx, 0x4a5fd0
mov edx, esi
mov eax, edi
call fcn.0049cee8
cmp byte [0x4a5eac], 0
jne 0x49e68e
push 0x12c
call sub.kernel32.dll_Sleep
call fcn.0049c484
mov dword [0x4a5fec], eax
cmp dword [0x4a5fec], 0
jne 0x49e52a
call fcn.00497560
mov eax, ebx
call fcn.00499790
mov eax, dword [ebx]
call fcn.00497bec
test al, al
je 0x49e443
mov eax, dword [ebx]
call fcn.0040be4c
fstp qword [ebp - 8]
wait
call fcn.0040a980
fadd qword [ebp - 8]
fstp qword [0x4a5e6c]
wait
jmp 0x49e454
mov eax, 0x49e6d4
call fcn.0040be4c
fstp qword [0x4a5e6c]
wait
xor eax, eax
mov dword [0x4a5e78], eax
mov eax, 0x4a5fd0
call fcn.0049a2ec
lea eax, [ebp - 0x44]
push eax
mov cl, 1
mov edx, 0x99bf9
mov eax, dword [0x4a5fd0]
call fcn.00496d84
mov edx, dword [ebp - 0x44]
mov eax, 0x4a5fd0
call fcn.00404784
mov eax, esi
call fcn.0049841c
mov eax, dword [esi]
mov edx, 0x49e7fc
call fcn.00404b3c
jne 0x49e4a6
mov eax, 0x4a5fd0
call fcn.00404730
mov eax, dword [esi]
mov edx, 0x49e810
call fcn.00404b3c
jne 0x49e4eb
mov eax, esi
call fcn.00499ff0
mov eax, dword [esi]
mov edx, 0x49e7d8
call fcn.00404b3c
jne 0x49e4d3
mov eax, 0x4a5fd0
call fcn.0049a3e0
mov eax, dword [esi]
mov edx, 0x49e7b8
call fcn.00404b3c
jne 0x49e4eb
mov eax, 0x4a5fd0
call fcn.0049a3e0
mov eax, ebx
call fcn.00496c70
mov ecx, dword [0x4a5fd0]
mov edx, dword [ebx]
xor eax, eax
call fcn.00496e70
mov dword [0x4a5e74], 1
call fcn.00499d54
mov eax, ebx
call fcn.00498518
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e52a
call fcn.004974a4
mov eax, ebx
call fcn.00499ff0
mov eax, dword [ebx]
mov edx, 0x49e72c
call fcn.00404b3c
jne 0x49e54b
mov eax, ebx
mov edx, 0x49e7d8
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e7b8
call fcn.00404b3c
jne 0x49e565
mov eax, ebx
mov edx, 0x49e7d8
call fcn.00404784
mov eax, dword [ebx]
mov edx, 0x49e7d8
call fcn.00404b3c
jne 0x49e5a0
mov eax, ebx
call fcn.004994bc
mov eax, dword [ebx]
mov edx, 0x49e7e8
call fcn.00404b3c
jne 0x49e58d
call fcn.0049c608
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e5a0
call fcn.0049cb60
mov eax, ebx
call fcn.00499ff0
mov eax, dword [ebx]
mov edx, 0x49e7b8
call fcn.00404b3c
je 0x49e65c
mov eax, dword [ebx]
mov edx, 0x49e77c
call fcn.00404b3c
je 0x49e65c
mov eax, 0x4a5fd4
call fcn.00497240
mov eax, 0x4a5fd0
call fcn.00497794
mov eax, edi
mov edx, 0x49e7c4
call fcn.00404784
mov eax, esi
call fcn.00404730
mov eax, ebx
call fcn.0049bfbc
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e60c
call fcn.004976d8
mov eax, dword [ebx]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e65c
mov eax, dword [edi]
call fcn.00499a68
test al, al
jne 0x49e65c
mov eax, dword [0x4a5fd4]
mov edx, 0x49e6e8
call fcn.00404b3c
jne 0x49e65c
push 0
mov eax, dword [0x4a5fd0]
call fcn.00404bf0
push eax
mov eax, dword [esi]
call fcn.00404bf0
push eax
mov eax, dword [edi]
call fcn.00404bf0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp dword [0x4a5fec], 0
jne 0x49dab9
cmp byte [0x4a5eac], 0
je 0x49da93
mov eax, dword [0x4a37cc]
mov eax, dword [eax]
call fcn.004038ec
mov eax, dword [0x4a3810]
mov eax, dword [eax]
call fcn.004038ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e6b0
lea eax, [ebp - 0x44]
mov edx, 0xf
call fcn.00404754
ret