Function at 0x432b90
Capabilities:
Check for time delay via gettickcount
Check os version
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44cc1e
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xc4]
mov esi, ebp
call fcn.00431c10
mov edi, ebp
call fcn.00429ca0
lea edi, [ebp + 0x1c]
call fcn.00429ca0
lea edi, [ebp + 0x38]
call fcn.00429ca0
call fcn.00417cd0
mov dword [esp + 0xbc], 0xffffffff
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jg 0x432c25
mov eax, esi
cdq
idiv esi
test edx, edx
je 0x432c2a
call fcn.0042fef0
lea edi, [ebp + 0x54]
call fcn.00429ca0
lea edi, [ebp + 0x70]
call fcn.00429ca0
mov ebx, dword [ebp + 0xa0]
cmp dword [ebp + 0x9c], ebx
lea esi, [ebp + 0x90]
jbe 0x432c53
call fcn.00437e82
mov edi, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x14], edx
cmp edi, dword [esi + 0x10]
jbe 0x432c66
call fcn.00437e82
mov ecx, dword [esp + 0x14]
mov eax, dword [esi]
push ebx
push ecx
push edi
push eax
lea ebx, [esp + 0x24]
call fcn.00405440
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jle 0x432c9c
mov edx, 1
jmp 0x432ca1
mov eax, esi
cdq
idiv esi
mov eax, edx
sub eax, 1
jne 0x432cbf
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00406c60
lea edx, [esp + 0x38]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
mov dword [esp + 0x34], esp
cmp eax, ebx
jb 0x432cf1
mov ecx, dword [edi]
jmp 0x432cf3
mov ecx, edi
cmp ecx, 0x4565ec
ja 0x432d2c
cmp eax, ebx
jb 0x432d03
mov ecx, dword [edi]
jmp 0x432d05
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4565ec
jbe 0x432d2c
cmp eax, ebx
jb 0x432d18
mov edi, dword [edi]
push 0xa
mov eax, 0x4565ec
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x432d6e
cmp eax, 0xa
jae 0x432d3e
mov ecx, dword [esi + 0x14]
push ecx
push 0xa
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x432d49
mov eax, dword [edi]
jmp 0x432d4b
mov eax, edi
push 0xa
push 0x4565ec
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0xa
cmp dword [esi + 0x18], ebx
jb 0x432d6a
mov edi, dword [edi]
mov byte [edi + 0xa], 0
lea esi, [esp + 0x74]
call fcn.004014c0
mov dword [esp + 0xc0], 2
call fcn.00401580
mov byte [esp + 0xbc], 3
cmp dword [eax + 0x18], ebx
jb 0x432d99
mov ecx, dword [eax + 4]
jmp 0x432d9c
lea ecx, [eax + 4]
mov eax, ecx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x432db6
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00403090
lea edx, [esp + 0x1c]
push edx
lea ebx, [ebp + 0x90]
mov byte [esp + 0xc0], 4
call fcn.00429f20
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x34], esi
jb 0x432dfa
mov eax, dword [esp + 0x20]
push eax
call fcn.00437f8b
add esp, 4
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x50], esi
jb 0x432e20
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x54]
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0xbc], 0xffffffff
call fcn.00429620
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, 2
je 0x432e57
sub eax, 2
je 0x432e57
sub eax, 4
jne 0x432e67
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0042ff80
mov dword [ebp + 0xa8], ebx
mov dword [ebp + 0xac], ebx
mov dword [ebp + 0xb0], ebx
mov dword [ebp + 0xbc], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x432ea5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.00406c60
mov dword [ebp + 0xb4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x432ed7
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov eax, 1
jmp 0x432ed9
xor eax, eax
sub eax, 1
jne 0x432ee8
call fcn.0042fff0
call fcn.00430080
mov dword [ebp + 0xb8], ebx
call edi
sub eax, 2
je 0x432eff
sub eax, 2
je 0x432eff
sub eax, 4
jne 0x432f0b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00430130
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov dword [ebp + 0x8c], ebx
call esi
lea edx, [esp + 0x14]
cmp eax, edx
jle 0x432f30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 1
jmp 0x432f41
push 0xe
call esi
lea ecx, [esp + 0x14]
xor edx, edx
cmp eax, ecx
setg dl
mov ecx, edx
mov eax, 0x882dbf5f
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x785
jle 0x432f70
push 0x785
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00406fe0
call fcn.004301a0
mov dword [ebp + 0xc0], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x432fa5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00430250
call fcn.004302c0
xor eax, eax
mov dword [ebp + 0xc4], ebx
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00437983
add esp, 0xac
ret 4