Function at 0x45a89a
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebx + 0x20]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 4
mov esi, 0x4236c4
call fcn.00440071
and dword [ebx + 0x48], edi
cmp dword [ebx + 0x38], 2
je 0x45a8e3
push 0x4236dc
push 2
call fcn.004400fc
jmp 0x45adb8
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x38], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45a8f0
sub ecx, edx
lea esi, [ecx + 1]
push esi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov edi, eax
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test edi, edi
jne 0x45a91c
mov edi, 0x8007000e
push 0x423718
jmp 0x45a8d7
mov eax, dword [ebx + 0x50]
mov edx, esi
mov ecx, edi
call fcn.0043dbf8
push 0x3c
pop esi
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
xor esi, esi
push esi
mov ecx, 0x104
push esi
push edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [ebx + 0x22c]
test eax, eax
jne 0x45a9b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x45a993
push 0x57
pop edi
test edi, edi
jle 0x45a9a1
and edi, 0xffff
or edi, 0x80070000
push edi
push 0x423744
push 2
pop esi
call fcn.00440126
jmp 0x45ad9d
push esi
push esi
push 3
push esi
push esi
push dword [ebp - 0x34c]
push dword [ebp - 0x354]
push dword [ebx + 0x70]
call dword [ebx + 0x230]
mov dword [ebx + 0x74], eax
test eax, eax
jne 0x45a9fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x45a9e7
push 0x57
pop edi
test edi, edi
jle 0x45a9f5
and edi, 0xffff
or edi, 0x80070000
push edi
push 0x42376c
jmp 0x45a9a7
push esi
push 0x4400200
push esi
push esi
push esi
push dword [ebp - 0x338]
push 0x423798
push eax
call dword [ebx + 0x240]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebx + 0x78], eax
test eax, eax
jne 0x45aa4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x45aa36
push 0x57
pop edi
test edi, edi
jle 0x45aa44
and edi, 0xffff
or edi, 0x80070000
push edi
push 0x42379c
jmp 0x45a9a7
lea edi, [ebx + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
mov esi, 0x4237c8
call fcn.00440071
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor eax, eax
push eax
push eax
push eax
push eax
push esi
call dword [ebx + 0x244]
test eax, eax
je 0x45ad38
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20000013
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 4
call dword [ebx + 0x248]
test eax, eax
je 0x45ad1e
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
sub eax, 0xc8
je 0x45ab56
sub eax, 0xc9
je 0x45aafd
dec eax
dec eax
je 0x45aafd
dec eax
je 0x45aaf6
sub eax, 3
je 0x45aaef
dec eax
je 0x45aae8
sub eax, 0x5c
je 0x45aae1
mov eax, 0x800710e0
jmp 0x45ab02
mov eax, 0x8007003a
jmp 0x45ab02
mov eax, 0x8007041d
jmp 0x45ab02
mov eax, 0x80070041
jmp 0x45ab02
mov eax, 0x80070002
jmp 0x45ab02
mov eax, 0x80070005
push eax
push 0x42385c
push 2
pop esi
call fcn.00440126
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x197
pop ecx
pop ecx
jne 0x45ab45
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 0
push 7
push 0x2eee
push esi
push dword [ebx + 0x128c]
call dword [ebx + 0x23c]
cmp eax, 0x2f00
je 0x45aa6b
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 0x80072efd
jmp 0x45ad9f
lea esi, [ebx + 0x20]
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x38], 3
je 0x45abb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x45ab79
push 0x57
pop esi
test esi, esi
jle 0x45ab87
and esi, 0xffff
or esi, 0x80070000
push dword [ebx + 0x74]
call dword [ebx + 0x238]
push dword [ebx + 0x78]
and dword [ebx + 0x74], edi
call dword [ebx + 0x238]
and dword [ebx + 0x78], edi
push esi
push 0x423890
push 2
pop esi
call fcn.00440126
mov edi, 0x80004004
jmp 0x45ad9d
push esi
mov dword [ebx + 0x38], 4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
lea eax, [ebx + 0x40]
push eax
push 0x20000005
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 4
call dword [ebx + 0x248]
test eax, eax
jne 0x45ac0a
push 0x4238b8
push 4
pop esi
call fcn.00440126
or dword [ebx + 0x40], 0xffffffff
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
pop ecx
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push ecx
jmp 0x45ac93
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
je 0x45acd9
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x314]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45acf7
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
add dword [ebx + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
test ecx, ecx
je 0x45ac8c
mov eax, dword [ebx + 0x44]
xor edx, edx
div ecx
mov dword [ebx + 0x48], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x1000
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [ebx + 0x234]
test eax, eax
jne 0x45ac2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x45acbb
push 0x57
pop edi
test edi, edi
jle 0x45acc9
and edi, 0xffff
or edi, 0x80070000
push edi
push 0x4238e8
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x38], 4
je 0x45ad9f
mov edi, 0x80004004
jmp 0x45ad9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x45ad08
push 0x57
pop edi
test edi, edi
jle 0x45ad16
and edi, 0xffff
or edi, 0x80070000
push edi
push 0x42391c
jmp 0x45accf
lea eax, [ebx + 0x20]
push eax
mov edi, 0x8007000d
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push 0x423824
jmp 0x45a9a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x45ad49
push 0x57
pop esi
test esi, esi
jle 0x45ad57
and esi, 0xffff
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x100
call dword [ebx + 0x24c]
push esi
push 0x4237f4
push 2
pop esi
call fcn.00440126
mov edi, 0x80072efd
pop ecx
pop ecx
push dword [ebp - 0x324]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
cmp edi, 0x80004004
je 0x45ae6c
push 4
mov esi, 0x423948
call fcn.00440071
xor eax, eax
test edi, edi
setns al
mov dword [ebx + 0x3c], edi
lea eax, [eax*4 + 1]
mov dword [ebx + 0x38], eax
cmp dword [ebx + 0x7c], 0xffffffff
je 0x45adeb
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0x7c], 0xffffffff
test edi, edi
jns 0x45ae00
cmp dword [ebx + 0x60], 0
je 0x45ae00
push dword [ebx + 0x54]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x45ae04
and dword [ebx + 0x60], 0
mov edi, dword [ebx + reloc.ADVAPI32.dll_TraceMessage]
and dword [ebx + reloc.ADVAPI32.dll_TraceMessage], 0
test edi, edi
je 0x45ae33
mov esi, dword [ebx + 0x4c]
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0xc]
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x38], 5
je 0x45ae6c
cmp dword [ebx + 0x50], 0
je 0x45ae50
push 0x2f
push dword [ebx + 0x50]
call dword [sym.imp.msvcrt.dll_strrchr]
pop ecx
pop ecx
test eax, eax
jne 0x45ae55
mov eax, 0x423960
push dword [ebx + 0x40]
push dword [ebx + 0x44]
push eax
push 0x423968
push 4
pop esi
call fcn.00440126
add esp, 0x10
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret