Function at 0x4034ea
Capabilities:
Check for time delay via gettickcount
Create process on windows
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push edi
mov al, byte [0x409928]
mov byte [ebp - 0x24c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x24b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x144], 0
cmp dword [ebp + 8], 0
jne 0x403528
xor al, al
jmp 0x40382f
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 5
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x403557
xor al, al
jmp 0x40382f
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x408be8
mov ecx, dword [ebp - 0x14c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.Running_Startup_Folder___s___initial_delay_5__retry_for_up_to_60_seconds_
call fcn.004027ab
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
jne 0x4035c4
xor al, al
jmp 0x40382f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x144], eax
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push 0x408c38
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4037f3
push 0x408c3c
lea ecx, [ebp - 0x114]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4037f3
push str.COPY_OF
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x403633
jmp 0x403618
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x408c48
lea edx, [ebp - 0x24c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str..BAT
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x403685
push str..CMD
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4036cf
lea edx, [ebp - 0x114]
push edx
push str.Attempting_to_run___s__MINIMISED
call fcn.004027ab
add esp, 8
push 0
push 1
push 0x1f4
lea eax, [ebp - 0x24c]
push eax
call fcn.004065bd
add esp, 0x10
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x4036ca
mov dword [ebp - 0x250], 0x2a
jmp 0x403762
push str..EXE
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40372f
lea edx, [ebp - 0x114]
push edx
push str.Attempting_to_run___s__SHOWDEFAULT
call fcn.004027ab
add esp, 8
push 0
push 0
push 0x1f4
lea eax, [ebp - 0x24c]
push eax
call fcn.004065bd
add esp, 0x10
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x40372d
mov dword [ebp - 0x250], 0x2a
jmp 0x403762
lea ecx, [ebp - 0x114]
push ecx
push str.Attempting_to_run___s__DOCUMENT
call fcn.004027ab
add esp, 8
push 0xa
mov edx, dword [ebp + 8]
push edx
push 0
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x20
jae 0x4037df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
push str.Shell_process_startup_failed_code_d_gla_d__retry
call fcn.004027ab
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x144]
jb 0x4037a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x144]
mov dword [ebp - 0x254], eax
jmp 0x4037c1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x144]
sub edx, eax
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xea60
jb 0x4037cf
jmp 0x4037f3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403618
mov ecx, dword [ebp - 0x250]
push ecx
push str.Shell_startup_success__continue
call fcn.004027ab
add esp, 8
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4035d0
push str.Startup_Folder_complete
call fcn.004027ab
add esp, 4
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
neg eax
sbb eax, eax
neg eax
pop edi
mov esp, ebp
pop ebp
ret