Function at 0x44d40e
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Delete file

Disassembly:
mov eax, 0x547096
call fcn.0054565c
sub esp, 0x50
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 2
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
rcl byte fs:[eax + eax - 1]
rol dword [ebx - 0x78f0f408], cl
inc dword [ecx]
add byte [eax], al
cmp eax, 0xb
ja 0x44d63d
sbb byte gs:[eax - 0x21], bh
inc ebp
mov bl, 0x34
inc ecx
popfd
jb 0x44d435
sub eax, 0xc76f1fae
push esi
xchg esp, eax
pop es
push esp
out dx, eax
dec ebp
cwde
mov bl, 0xd8
mov bh, 0x26
jmp 0x44d42f
push esi
lea ecx, [ebp - 0x58]
call fcn.004018ce
mov byte [ebp - 4], 3
call ebx
cmp eax, 0x11
ja 0x44d854
je 0x44d662
invalid
ljmp 0x405f:0x91aec290
push 0
push 0x553ec0
mov ecx, esi
call fcn.00402a1d
call ebx
cmp eax, 0x16
ja 0x44da6c
invalid
mov byte [ebp - 0x11], 0
call ebx
cmp eax, 0x1b
ja 0x44dc7a
retf 0x2682
call fcn.004ae8cf
cmp dword [eax + 4], 0
je 0x4501ac
call fcn.004ae8cf
cmp dword [eax + 0xd8], 0
je 0x4501ac
cmp dword [ebp + 0x3c], 8
lea eax, [ebp + 0x28]
cmovae eax, dword [ebp + 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401a3b
mov byte [ebp - 4], 4
call ebx
cmp eax, 0x24
ja 0x44debd
pop es
push ecx
xor al, 0x37
pop esp
shl dword [esi - 0x4c], cl
in eax, 0x75
sqrtps xmm1, xmmword [edx + eax*2 + 0x1550149b]
or ecx, dword [eax + edx*2 + 0x5b]
movsd dword es:[edi], dword [esi]
ja 0x44dcfc
sbb ch, cl
bound esi, qword [ebp + 0x33]
enter 0xffffffffffffc592, 0xffffffffffffffe4
adc ebx, esp
invalid
inc esp
push esi
retf 0xdfe6
lodsd eax, dword [esi]
or ch, al
push edx
enter 0xffffffffffffb0c3, 0xffffffffffffff80
mov eax, 0x14f37dc3
aad 0x14
add al, 0x9d
inc ebp
loop 0x44df2d
les edx, [edx + 0x7c]
mov al, 0x6c
fild word [ebp - 0x2c940f3f]
inc esp
push 0xe44d8b43
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402beb
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
call 0x6412498
call ebx
cmp eax, 0x2a
ja 0x44e0dc
int 0xc
sub dh, dh
pop ss
inc edx
mov cl, byte [edx]
jb 0x44de9b
out dx, al
in eax, dx
fnsave dword [eax - 2]
add byte cs:[edx + 0x5acbed37], dl
movsd dword es:[edi], dword [esi]
xchg ecx, eax
pop ebx
sub ch, 0xb9
sbb eax, 0x357491ce
in al, 0x70
mov ah, 0x21
pop esi
mov word [eax], es
cdq
push ds
adc byte [edx - 0x46], ch
loope 0x44de9e
xchg edx, eax
shl dword [edi + edx - 0x6b], 7
loope 0x44df06
push edx
and eax, 0xdeb8bec7
pop ds
jo 0x44decd
add al, dh
and dword [edi + 0x47fd14e4], 0x84d7bc0d
xor dh, bl
jg 0x44df0b
aad 0xb6
aad 0xb6
out 0x87, al
add al, 0xa2
sti
add eax, 0xc4571d92
and dword [ebx + 0x4f], edx
push ebp
dec eax
mov ebp, ss
outsb dx, byte [esi]
cmp dword [esi + 0x41], eax
lcall 0x71d0, 0x2f5287a1
outsd dx, dword [esi]
sbb byte [edx], 0x17
xor edx, dword [ebp + 0x7d]
invalid
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402beb
lea edi, [eax + 0x10]
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 6
call ebx
cmp eax, 0x2f
ja 0x44e2fb
outsd dx, dword [esi]
mov byte [0xb8c8c94f], al
xchg ecx, eax
mov ebp, 0xdcb614ff
cmp esp, esp
or dl, dl
mov ebp, 0x1be0a864
hlt
cmp dword [ebp - 0x48], 0
jne 0x44e557
push edi
push ecx
mov ecx, dword [ebp - 0x1c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00402beb
add eax, 0x10
lea ecx, [ebp - 0x20]
mov dword [esi], eax
call fcn.00460285
pop ecx
mov byte [ebp - 4], 7
push dword [eax]
lea eax, [ebp - 0x18]
push str._s_s
push eax
call fcn.0040326a
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x20]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.004013c0
call ebx
cmp eax, 0x36
ja 0x44e79c
retf
sbb bl, dh
dec ebx
xchg byte [ecx - 8], al
mov es, word [edi - 0x65]
push edi
outsb dx, byte [esi]
cli
into
pop ss
pop edi
into
mov eax, dword [0x616e02f5]
sbb dword [edx + 0x19348378], ebp
xor byte [edx + 0x2b768acb], cl
jmp 0x44e79c
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401a3b
push edi
mov byte [ebp - 4], 8
push dword [eax]
lea eax, [ebp - 0x18]
push str._s_s
push eax
call fcn.0040326a
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x20]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.004013c0
call ebx
cmp eax, 0x3e
ja 0x44e79c
sal ebp, cl
cmc
scasd eax, dword es:[edi]
jge 0x44e531
sahf
lcall 0x3784, 0x8a558e53
jmp 0x4a576211
cmp dword [ebp + 0x50], 0
je 0x44ea03
push 0x558280
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.00401d86
pop ecx
mov byte [ebp - 4], 9
cmp dword [ebp + 0x54], 8
lea ecx, [ebp + 0x40]
cmovae ecx, dword [ebp + 0x40]
push ecx
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.00401d86
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.00401ad5
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.004013c0
call ebx
cmp eax, 0x46
ja 0x44ea03
jmp 0x4595562b
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
cmp eax, 0x4c
ja 0x44ec17
and dh, byte [esi + 1]
cmp byte [esp + ebp*4 - 0x544df368], bh
das
int3
cmp dword [ebp + 0x24], 8
lea ebx, [ebp + 0x10]
cmovae ebx, dword [ebp + 0x10]
call fcn.004ae8cf
push ebx
call dword [eax + 4]
cmp dword [esi - 4], 1
jle 0x44ec3f
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.0040266b
mov esi, dword [ebp - 0x18]
cmp dword [ebp + 0x24], 8
lea ebx, [ebp + 0x10]
cmovae ebx, dword [ebp + 0x10]
call fcn.004ae8cf
push 0
push 0
push esi
push ebx
push 0
call dword [eax + 0xd8]
test eax, eax
jne 0x45018f
cmp dword [esi - 4], 1
jle 0x44ec79
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.0040266b
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
push esi
call fcn.00402293
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp eax, 0x55
ja 0x44ee92
hlt
call ebx
cmp eax, 0x5a
ja 0x44f09c
add dword [eax], eax
add byte [ecx + 0x70010e62], bh
mov ecx, 0x70010e62
mov ebx, 0xcbf4e8c2
pop es
std
dec edx
dec edx
inc ebx
pop edi
and edi, ecx
les esi, [ecx + 0x6c]
jecxz 0x44eead
cmp dword [ecx], esp
loop 0x44ee9a
push es
bound esp, qword [esi - 0x3b]
push esi
enter 0x2372, 0xfffffffffffffff6
stc
out 0xea, eax
imul edi, dword [edx + 5], 0xffffffec
xchg ecx, eax
lds ebp, [edi]
nop
sbb byte [esi + ebp*8 + 0x399cb9c7], 0x42
js 0x44eeeb
hlt
je 0x44ef0d
in al, 0xb5
xchg edi, eax
fnstsw word [ecx - 0x36]
sbb eax, 0xc978a343
push ebp
sub eax, 0xffffff83
add byte [edx + 0x2bfcd03c], 0x39
xor al, 0
sal byte [edi + edi - 0x15], 1
sub bl, byte [eax]
mov dword [0x2a251a56], eax
sbb eax, 0x787363f0
jle 0x44ef32
je 0x44ef6e
xchg ecx, eax
xor byte [edx + edx*4 + 0x10], bh
inc ebp
invalid
mov edx, 0xfb2ca124
jmp 0xd6f65736
sahf
out dx, al
mov dword [0x9151f4c9], eax
sti
lodsb al, byte [esi]
xor dword [edi], 0xefd230a1
rol byte [edx - 0x72], 0x22
sub dword [0x9e4fb033], edi
fist dword [edx - 0x41033baa]
insb byte es:[edi], dx
hlt
and dword [ebp - 0x20], 0
call ebx
cmp eax, 0x5f
ja 0x44f2aa
jl 0x44f0c9
and byte [edi + edi*8], bl
add byte [esi + ebx*2 - 0x42], dh
jns 0x44f0d8
inc dword [eax]
je 0x44f111
mov esi, 0x5d4a2279
dec edx
pop ebp
mov al, 0x81
popf
jae 0x44f0af
and edi, dword [ebp - 0x30]
pop ds
or eax, 0x4584e3a6
add eax, 0xba312fec
movsb byte es:[edi], byte [esi]
lds esi, [edx + 0x31]
das
xor dword [edx + 0x3172c5a4], edi
rol dh, cl
push ss
mov ds, word [ecx]
adc dword [edi], ecx
dec edi
adc al, 0xab
in al, 0x2c
movsd dword es:[edi], dword [esi]
mov esp, 0xda8942a7
daa
jno 0x44f115
mov ah, byte [esi + 3]
int3
rol dword [edi], cl
jno 0x44f166
invalid
cli
push edx
rol byte [edi + edi*4 - 0x1959539d], 0x91
jnp 0x44f1dd
inc esi
movsb byte es:[edi], byte [esi]
ljmp 0xd6ea
and dword [ebp + 0x7f89b6f5], ebx
cmp al, 0x54
xchg esp, eax
out dx, al
jg 0x44f205
retf 0x24e2
dec eax
inc edi
sbb dword [edi - 0x62], esp
inc ebx
outsb dx, byte [esi]
int 0x7b
mov ebx, 0x5485120d
pop esi
lldt dx
popal
rcl byte [ecx + 0x47f195cf], cl
mov bl, 0x18
push ds
feni8087_nop
paddb mm6, qword [edi]
sub eax, 0x96363248
push ds
mov ebp, 0x8a9d32ab
movsb byte es:[edi], byte [esi]
out 0x44, eax
invalid
and dh, 0x73
sub byte [ebx - 0x1e], 0x8b
inc ebp
fadd qword [ebx + 0x72081478]
add cl, byte [ebx - 0x1fb27300]
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x44f2b5
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x40]
mov ecx, eax
call fcn.0047786e
pop ecx
call ebx
cmp eax, 0x64
ja 0x44f4ce
add byte [ebx - 0x33c4d1f1], 0x1f
jle 0x44f2e1
invalid
push ebx
cmp dl, byte [ecx + 0x31abc459]
loop 0x44f31f
jbe 0x44f2a4
aad 6
dec eax
lodsd eax, dword [esi]
out dx, al
adc dword [eax - 0x2f], ebp
cmp edi, dword [edx]
hlt
invalid
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
call ebx
cmp eax, 0x69
ja 0x44f6e0
inc edi
sbb eax, 0x698c935a
push 0xffffffffffffffcf
fadd st(4)
fidiv dword [eax + eax*8]
dec dword [edi - 0x782221d5]
ret
cmp dword [ebp - 0x20], 0
seta byte [ebp - 0x11]
call ebx
cmp eax, 1
ja 0x44f704
invalid
mov eax, dword [ebp + 8]
test eax, eax
je 0x45018f
cmp dword [ebp + 0xc], 0
je 0x45018f
cmp dword [eax], 0
jne 0x45018f
and dword [ebp - 0x20], 0
call ebx
cmp eax, 0xa
ja 0x44f930
mov edx, 0xb35c819f
test al, 0xcb
mov dword [ecx - 0x32], ecx
jecxz 0x44f728
imul edx, ebp, 0xffffffc5
lcall 0xfb41, 0xbbc0bf9e
fcom dword [ebp + 0x16]
push ss
fisubr dword [eax + 0x60]
inc byte [edx + 0xc]
pop ds
add al, 0xa6
mov ebp, 0x3e359db0
loop 0x44f788
push edx
mov eax, 0xa145cf46
mov dword [edi + 0x30], ecx
loope 0x44f765
js 0x44f7ab
cmp byte [ebp - 0x7d25cb6c], al
xor dl, ch
pop ebp
dec ebx
pop ds
jp 0x44f749
mov cl, 0xc2
push esp
aam 0x87
mov ebp, 0x80b0381a
pop edx
sbb edx, dword [esi - 0x20]
add byte [esi], 0xad
ror byte [ecx], cl
mov dword [0xcefe6989], eax
and dword [edx + 0x113eef2], edx
adc dword [esi + 0x7926ba9], eax
pop ebx
not byte [edx - 0x17]
imul edx, dword [edx + 0x52f65b07], 0xffffffe9
xchg ebp, eax
out dx, al
mov ebx, 0xebb9baf9
cmc
push 0xfe56120d
pushal
sbb al, 0x6d
pop ebx
mov al, byte [0x25e9b191]
mov ecx, 0x3e4db58
and al, 0xb2
in eax, 0xa7
add byte [esi], 0xf7
mov ecx, ebx
and dword [edx + 0x5d32f464], 0x1d
inc edi
stc
add dword [esi + eax*4 + 0x66], edi
jle 0x44f7d3
cmp al, 0xa8
int3
adc al, 0x4e
fisub word [0x7295d359]
arpl word [0x3891038b], sp
mov ecx, 0x912b3482
sub dh, al
sbb eax, 0x42663485
enter 0xf92, 0x36
pop eax
loopne 0x44f85f
xchg ecx, eax
cmp al, 0x98
pop esp
mov ebx, 0x2cc850a
lodsd eax, dword [esi]
jp 0x44f796
jmp 0xc3e93b6a
outsd dx, dword [esi]
and dword [ecx - 0x2a], edi
sbb dword [edi - 0x70], 0x61
mov dh, 0x8f
ljmp 0xef2b
clc
pushal
das
pop esp
stc
in al, 0x4f
cmp dh, dh
add byte [eax], 0xd4
push ecx
pop ds
push ebx
xchg ecx, eax
cmp al, byte [ebx - 0x73]
sub dl, al
pushfd
jae 0x44f8cf
mov cl, bl
lds edx, [esi]
sar dword [esi + 0x77fbb509], cl
mov dword [ecx + 0x4e], esi
sub al, 0x9f
sar dword [edi - 0x2b], cl
xor byte [edi + 0x1775049], dh
push ebp
mov al, 4
mov word [esi - 0x27], ds
add al, 0x63
xchg ebx, eax
dec edx
ret 0x3d34
and dword [ebp - 0x24], 0
call ebx
cmp eax, 0xf
ja 0x44fb3e
push ebx
cmp eax, 0xfc2f00cd
js 0x44f8d3
sub esi, dword [eax + 0x22]
mov ch, 0x74
sub dword [ecx - 0x4a], 0xd43b4e31
pushal
cmp esi, dword [bp + di]
bound edi, qword [0xd7baef66]
imul byte [eax + 0x12]
mov byte [esi + 0x785a7edd], 0x3d
add eax, 0x5e399416
invalid
cmp dword [esi - 4], 1
jle 0x44fb52
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.0040266b
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.0045ffa2
pop ecx
call ebx
cmp eax, 0x14
ja 0x44fd6b
add byte [ebx + 0x7b], dh
in al, dx
jmp 0xf5a5f6a9
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
call ebx
cmp eax, 0x19
ja 0x44ff7d
mov ebx, dword [0xd5ab5422]
clc
pop ss
aam 0x41
aas
fsubrp st(6)
adc ecx, edi
ja 0x44fd98
and dword [edi - 0x4a5f62ba], ebx
lea esi, [eax + 0x71]
mov al, byte [0xbcd134eb]
and dh, byte [eax]
cmp ebp, dword [edx - 0x1877cae3]
xor esp, edx
pop ebx
mov dword [0xd0bccea3], eax
push 0xffffffffffffffcc
add edi, dword [ecx + 0x37]
push eax
clc
push ebp
mov bl, 0xec
cmp byte [edi + eax - 0x5de6244e], bl
jmp 0x44fe13
pop ds
pop ecx
cmp dword [esi - 0x18b540ae], ebx
inc ecx
into
lds esi, [edi + 0x67bc724e]
mov ebx, 0x128f2df1
rol byte [ebp + 0x629bc479], 0xd6
adc ah, dl
popfd
scasd eax, dword es:[edi]
in al, dx
mov byte [esi + 0x3d74608d], bl
ret 0x77c5
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
call ebx
cmp eax, 0x1e
ja 0x45018f
rcr byte [edi], 0xa
bound edi, qword [ecx + edi*2 - 0x6f]
dec esp
adc dword [edi + 0x5e], 0xfffffff2
mov al, 0xb9
sal byte [eax + esi*2 - 0x1b], 0x35
imul ecx, ecx, 0x5c
mov bh, byte [ebp - 0x64]
or al, 0x44
das
daa
invalid
lea ecx, [edi - 0x10]
call fcn.004013c0
lea ecx, [esi - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004013c0
jmp 0x4501b0
mov byte [ebp - 0x11], 0
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp + 0x10]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp + 0x28]
call fcn.004023ba
push 0
push 1
lea ecx, [ebp + 0x40]
call fcn.004023ba