Function at 0x4078f0
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427e33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov dword [esp + 0xc], esi
call edi
xor ecx, ecx
cmp byte [ebp + 0xc], cl
mov dword [esp + 0x18], eax
sete cl
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], eax
lea ecx, [ecx + ecx + 1]
mov dword [esp + 0x20], ecx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xa4], esi
cmp dword [ebx + 0x38], 0
lea esi, [ebx + 0x38]
je 0x40797e
mov edx, dword [esp + 0xc]
push edx
call edi
sub eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
call fcn.004077d0
xor eax, eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 0x18], 8
mov dword [esp + 0x10], 0
jb 0x407994
mov eax, dword [ebx + 4]
add ebx, 4
jmp 0x407999
add ebx, 4
mov eax, ebx
push eax
call dword [sym.imp.ole32.dll_StgIsStorageFile]
cmp byte [ebp + 0xc], 0
mov edi, dword [sym.imp.ole32.dll_StgOpenStorage]
mov dword [esp + 0xc], eax
je 0x4079d8
test eax, eax
je 0x4079fa
lea esi, [esp + 0x18]
mov edi, eax
call fcn.004078a0
mov eax, edi
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4079fa
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x4079e9
mov eax, dword [ebx]
jmp 0x4079eb
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407a28
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 8
jb 0x407a07
mov eax, dword [ebx]
jmp 0x407a09
mov eax, ebx
mov dl, byte [ebp + 0xc]
neg dl
push esi
push 0
push 0
sbb edx, edx
and edx, 0x1e
add edx, 0x400022
push edx
push 0
push eax
call edi
mov dword [esp + 0xc], eax
cmp eax, 0x80030021
jne 0x407a7d
nop
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, 3
mov dword [esp + 0x10], ecx
jge 0x407a7d
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x407a55
mov eax, dword [ebx]
jmp 0x407a57
mov eax, ebx
mov cl, byte [ebp + 0xc]
neg cl
push esi
push 0
push 0
sbb ecx, ecx
and ecx, 0x1e
add ecx, 0x400022
push ecx
push 0
push eax
call edi
cmp eax, 0x80030021
mov dword [esp + 0xc], eax
je 0x407a30
cmp eax, 0x80030002
jne 0x407ab0
cmp byte [ebp + 0xc], 0
jne 0x407d27
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 8
jb 0x407a9b
mov eax, dword [ebx]
jmp 0x407a9d
mov eax, ebx
push esi
push 0
push 0x401022
push eax
call dword [sym.imp.ole32.dll_StgCreateDocfile]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x407d27
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x30], eax
mov edi, dword [esi]
mov dword [esp + 0x14], eax
je 0x407d27
lea eax, [ebx + 0x1c]
push eax
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x60]
mov byte [esp + 0xa4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor ecx, ecx
cmp byte [ebp + 0xc], cl
mov byte [esp + 0xa4], 3
sete cl
lea ecx, [ecx + ecx + 0x10]
mov dword [esp + 0x24], ecx
push 0
push 0x438838
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov esi, eax
cmp esi, 0xffffffff
je 0x407baf
push esi
push 0
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 4
call dword [0x42e210]
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa4], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov ecx, dword [eax]
push ecx
add esi, 1
push esi
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xa8], 5
call dword [0x42e210]
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa4], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x407bc8
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
call dword [0x42e210]
lea ecx, [esp + 0x60]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x407bdb
lea eax, [esp + 0x2c]
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
push 0
push eax
mov eax, dword [ecx + 0x18]
push edi
call eax
test eax, eax
mov dword [esp + 0xc], eax
je 0x407c92
cmp byte [ebp + 0xc], 0
jne 0x407c8e
mov eax, dword [ebx + 0x38]
test eax, eax
mov dword [esp + 0x10], 0
je 0x407c3c
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x42e70c
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x407c3c
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0xffffffffffffffff
push eax
call edx
mov byte [esp + 0xa4], 6
cmp dword [esp + 0x40], esi
mov eax, dword [esp + 0x2c]
jae 0x407c52
lea eax, [esp + 0x2c]
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0x12
push eax
mov eax, dword [ecx + 0x14]
push edi
call eax
mov byte [esp + 0xa4], 3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407cdf
mov eax, dword [ebx + 0x40]
mov esi, dword [eax]
mov ecx, dword [esi + 4]
add ebx, 0x3c
lea eax, [esp + 0x14]
push eax
push ecx
push esi
call fcn.00408440
mov ecx, ebx
mov edi, eax
call fcn.00408480
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
cmp dword [esp + 0x74], 0
je 0x407cdc
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x48]
call dword [0x42e210]
mov ebx, dword [ebp + 8]
jmp 0x407b14
mov ebx, dword [ebp + 8]
lea ecx, [esp + 0x28]
mov byte [esp + 0xa4], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x60]
mov byte [esp + 0xa4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x44]
mov byte [esp + 0xa4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407d27
push ebx
call fcn.00407d60
mov eax, dword [esp + 0xc]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
call fcn.004077d0
mov ecx, dword [esp + 0x9c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8