Function at 0x4049b8
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xaa8
call fcn.00404378
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x11
cmp eax, 0x111
je 0x404a91
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0xaf0]
mov r13, qword [rsp + 0xaf0]
mov rbp, qword [rsp + 0xaf0]
mov r12, qword [rsp + 0xaf0]
mov r14, qword [rsp + 0xaf0]
mov rsi, qword [rsp + 0xaf0]
mov dword [rsp + 0xaf0], ebx
mov dword [0x00406014], eax
mov edi, dword [rsp + 0xaf0]
mov r15, qword [rsp + 0xaf0]
mov dword [rsp + 0xaf8], edi
mov edi, dword [rsp + 0xaf0]
mov dword [rsp + 0xb00], edi
xor edi, edi
call fcn.00496000
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
je 0x404c31
cmp eax, edi
je 0x40533c
cmp eax, 1
je 0x404a4d
mov ebx, dword [rsp + 0xaf0]
jmp 0x404aeb
mov ebx, dword [rsp + 0xaf0]
mov r13, qword [rsp + 0xaf0]
mov rbp, qword [rsp + 0xaf0]
mov r12, qword [rsp + 0xaf0]
mov r14, qword [rsp + 0xaf0]
mov rsi, qword [rsp + 0xaf0]
mov dword [rsp + 0xaf0], ebx
mov eax, dword [rsp + 0xaf0]
mov ecx, dword [rsp + 0xaf0]
mov r15, qword [rsp + 0xaf0]
mov dword [rsp + 0xaf8], eax
mov dword [rsp + 0xb00], ecx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.00404528
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
je 0x404b44
xor edi, edi
cmp eax, edi
je 0x40533c
cmp eax, 1
je 0x404a4d
jmp 0x404aeb
mov eax, dword [rsp + 0xaf8]
lea rcx, [rsp + 0x70]
mov edx, 4
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xaf0]
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x88], eax
mov qword [rsp + 0x80], rdi
call fcn.004030c0
cmp eax, 1
jne 0x4053de
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00404528
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
jne 0x404b2f
mov rcx, rdi
call fcn.00404658
mov edx, dword [rsp + 0xaf0]
mov r8d, 0x8000
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r14d, r14d
cmp rbx, r14
je 0x405408
mov rcx, rbx
call fcn.004044d8
lea rdx, [0x00401368]
mov rcx, rbx
call fcn.00404578
mov rbx, rax
cmp rax, r14
jne 0x405351
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x00401370]
jmp 0x4053f8
mov dword [rsp + 0xa94], edi
mov word [rsp + 0x680], di
mov dword [rsp + 0x554], edi
mov word [rsp + 0x140], di
call fcn.00404528
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
jne 0x404a7b
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11, qword gs:[0x30]
movabs r13, 0x74636a6e696d7678
mov rbx, qword [r11 + 0x60]
add rbx, 0xfe0
cmp qword [rbx], r13
je 0x404d6b
lea rcx, [rsp + 0x560]
mov dword [rsp + 0x560], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x564], 5
ja 0x404d64
xor ebp, ebp
lea rdx, [rsp + 0x40]
mov r8d, 0x30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, rbp
je 0x40515e
mov ecx, dword [rsp + 0x130]
mov rax, qword [rsp + 0x40]
xor edx, edx
div rcx
cmp rdx, rbp
jne 0x404d36
mov eax, 0x1000
cmp qword [rsp + 0x58], rax
jne 0x404d36
cmp dword [rsp + 0x60], eax
jne 0x404d36
cmp dword [rsp + 0x68], 0x20000
jne 0x404d36
cmp dword [rsp + 0x64], 4
jne 0x404d36
cmp qword [rdi], r13
je 0x404d46
add rdi, qword [rsp + 0x58]
cmp rdi, 0x7fff0000
jae 0x404d62
jmp 0x404cdb
lea rdx, [rbx + 0x20]
mov rcx, rbx
cmp rbx, rdx
je 0x404d62
sub rdi, rbx
mov al, byte [rcx + rdi]
mov byte [rcx], al
inc rcx
cmp rcx, rdx
jne 0x404d55
xor edi, edi
cmp qword [rbx], r13
cmovne rbx, rdi
mov r13, rdi
mov rbp, rdi
cmp rbx, rdi
je 0x404dd8
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
lea ebp, [r9 + 6]
mov qword [rsp + 0x20], rdi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
cmp rax, rdi
je 0x405239
mov ecx, dword [rax + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
cmp rax, rdi
je 0x4051e4
mov edx, dword [rax + 0x4c]
mov r8d, dword [rax + 0x48]
lea rcx, [rsp + 0x680]
add rdx, rax
call fcn.004055c4
jmp 0x404e15
lea rdx, [rsp + 0x680]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rsp + 0x680]
mov eax, edi
cmp word [rsp + 0x680], di
je 0x404e0e
add r11, 2
inc eax
cmp word [r11], di
jne 0x404e02
mov dword [rsp + 0xa94], eax
call fcn.00404528
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
jne 0x404a7b
or ebx, 0xffffffff
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x140]
mov r8d, ebx
call fcn.004055c4
lea rdx, [0x00401154]
lea rcx, [rsp + 0x140]
mov r8d, ebx
call fcn.004055c4
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x680]
lea r8d, [r9 + 7]
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x40532a
lea rcx, [0x00401238]
call fcn.004043e8
cmp eax, edi
jne 0x404a4d
xor r9d, r9d
xor edx, edx
mov rcx, r12
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp rax, rdi
je 0x405318
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
cmp rax, rdi
je 0x405306
mov rcx, rax
call fcn.00404478
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [rsp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
cmp eax, ecx
je 0x4052f4
cmp dword [rsp + 0xf0], ecx
jne 0x404f54
cmp dword [rsp + 0xf4], edi
jbe 0x40543d
lea ecx, [rdi + 0x1000]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
lea edx, [r9 + 4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor edi, edi
mov rsi, rax
cmp rax, rdi
je 0x4052e2
call fcn.00404528
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00406014]
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
mov edx, r11d
sub edx, ecx
test r11d, 0xffff8000
je 0x404fba
cmp edx, edi
je 0x40533c
cmp edx, 1
jmp 0x404a86
mov rcx, rsi
call fcn.00404478
mov r11d, eax
add r11, rsi
cmp dword [r11], 0x6d7678
jne 0x4052c3
cmp dword [r11 + 4], 3
jne 0x4052a4
mov edx, dword [r11 + 8]
mov ebx, edx
imul ebx, ebx, 0x8088405
inc ebx
mov eax, ebx
xor eax, edx
cmp eax, dword [r11 + 0xc]
jne 0x405285
mov ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov eax, ecx
xor eax, ebx
cmp eax, dword [r11 + 0x10]
jne 0x405266
mov eax, dword [r11 + 0x18]
imul ecx, ecx, 0x2b9ad7e7
add r11, 0x20
mov edx, 0x8088406
sub edx, ecx
mov ecx, dword [r11 - 4]
xor eax, edx
imul edx, edx, 0x8088405
inc edx
xor ecx, edx
imul edx, edx, 0x8088405
mov dword [rsp + 0xaf0], ecx
mov rcx, rsi
inc edx
xor edx, dword [r11]
sub r11d, esi
lea edi, [r11 + rax + 4]
mov dword [rsp + 0xaf8], edx
lea r15d, [rdi + rdx]
mov dword [rsp + 0xb00], r15d
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor r9d, r9d
lea r8d, [rsi + 8]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp rax, rsi
je 0x405257
mov eax, r15d
lea edx, [rsi + 1]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
xor eax, eax
cmp rsi, rax
je 0x405248
mov r15d, edi
mov edi, dword [rsp + 0xaf8]
add r15, rsi
mov rcx, r15
cmp edi, eax
jbe 0x4050fc
mov rdx, rdi
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov eax, ebx
shr eax, 0x10
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x4050e0
xor edi, edi
lea r8, [0x0040133c]
lea rcx, [rsp + 0x70]
lea r9d, [rdi + 0x58]
lea edx, [rdi + 0xf]
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x70], rdi
call fcn.004042c0
cmp eax, edi
je 0x404a88
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x00401348]
jmp 0x4053f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
or esi, 0xffffffff
lea rdx, [0x00401140]
lea rcx, [rsp + 0x140]
mov r8d, esi
mov ebx, eax
call fcn.004055c4
lea rcx, [rsp + 0x140]
mov r8d, 0xa
mov edx, ebx
call fcn.00405504
lea rdx, [0x00401154]
lea rcx, [rsp + 0x140]
mov r8d, esi
call fcn.004055c4
lea rcx, [rsp + 0x140]
mov r8d, 0x10
mov edx, edi
call fcn.00405504
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
mov r8d, esi
lea rdx, [rsp + 0x140]
jmp 0x4053fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401208]
lea rcx, [rsp + 0x140]
or r8d, 0xffffffff
mov ebx, eax
call fcn.004055c4
lea rcx, [rsp + 0x140]
mov r8d, 0xa
mov edx, ebx
call fcn.00405504
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [rsp + 0x140]
jmp 0x4053f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004011f0]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401328]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401310]
jmp 0x4051f1
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x00401300]
jmp 0x4053f8
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x004012f0]
jmp 0x4053f8
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x004012e0]
jmp 0x4053f8
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x004012d0]
jmp 0x4053f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004012b8]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x004012a0]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401288]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401270]
jmp 0x4051f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401220]
jmp 0x4051f1
mov rbx, qword [rsp + 0xaf0]
mov rdi, qword [rsp + 0xaf0]
xor r14d, r14d
jmp 0x40535c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
xor r9d, r9d
xor edx, edx
mov rcx, r12
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
cmp rax, r14
jne 0x405392
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x00401380]
jmp 0x4051f1
lea rdx, [rsp + 0xb08]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0xb00]
mov r8, qword [rsp + 0xb08]
add r9d, 0xffff
mov rdx, rsi
mov rcx, rdi
and r9d, 0xffff0000
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r13
call rbx
jmp 0x40543d
lea rdx, [0x00401160]
lea rcx, [0x00406020]
call fcn.00405634
lea rdx, [0x00401358]
or r8d, 0xffffffff
lea rcx, [0x00406020]
call fcn.004055c4
lea rcx, [0x004013a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x00401398]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x004013c0]
lea rdx, [0x00406020]
mov r9d, 0x10
xor ecx, ecx
call rax
add rsp, 0xaa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret