Function at 0x424873
Capabilities:
Check for time delay via gettickcount
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x3b4
push ebx
push esi
mov esi, dword [ebp + 0x70]
xor ebx, ebx
push edi
inc ebx
xor edi, edi
cmp byte [ebp + 0x7c], 0
mov dword [ebp + 0x54], ecx
jne 0x4248b3
mov ecx, dword [0x467b78]
push ebx
push edi
push 0xffffffffffffffff
push 0x45bf4c
call fcn.0040184e
cmp byte [esi], 0
je 0x4248c1
cmp dword [ebp + 0x74], edi
jne 0x4248b3
mov dword [ebp + 0x74], ebx
push esi
call fcn.00457cb0
cmp eax, 0x104
pop ecx
jb 0x4248c8
xor eax, eax
jmp 0x424db1
push 0x40
push dword [ebp + 0x6c]
lea eax, [ebp - 0x148]
push eax
call fcn.00439851
lea eax, [ebp - 0x350]
push esi
push eax
call fcn.00457a80
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.00457a80
lea eax, [ebp - 0x24c]
push 0x5c
push eax
call fcn.00458440
add esp, 0x24
cmp eax, edi
je 0x42491b
mov byte [eax + 1], 0
lea eax, [ebp - 0x24c]
push eax
call fcn.00457cb0
pop ecx
jmp 0x424924
mov byte [ebp - 0x24c], 0
xor eax, eax
lea ecx, [ebp + eax - 0x24c]
mov dword [ebp + 0x5c], ecx
mov ecx, 0x103
sub ecx, eax
lea eax, [ebp - 0x350]
push 0x5c
push eax
mov dword [ebp + 0x6c], ecx
call fcn.00458440
cmp eax, edi
pop ecx
pop ecx
je 0x42494f
inc eax
jmp 0x424955
lea eax, [ebp - 0x350]
push 0x45f510
push eax
mov dword [ebp + 0x60], eax
call fcn.00439b0d
test eax, eax
pop ecx
pop ecx
jne 0x424970
mov dword [ebp + 0x74], 2
mov ebx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x350]
push eax
xor esi, esi
mov dword [ebp + 0x70], edi
call ebx
cmp eax, 0xffffffff
mov dword [ebp + 0x58], eax
je 0x424c6e
jmp 0x42499b
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4681ac]
mov ecx, dword [0x465108]
cmp eax, dword [ecx + 0xb0]
jbe 0x4249e0
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4249d5
push 1
push 0xffffffffffffffff
call fcn.0040de6e
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4681ac], eax
test byte [ebp - 0xec], 0x10
je 0x424a20
cmp byte [ebp - 0xc0], 0x2e
jne 0x424a15
cmp byte [ebp - 0xbf], 0
je 0x424c4d
cmp byte [ebp - 0xbf], 0x2e
jne 0x424a15
cmp byte [ebp - 0xbe], 0
je 0x424c4d
cmp dword [ebp + 0x74], 1
jne 0x424a2a
jmp 0x424c4d
cmp dword [ebp + 0x74], 3
je 0x424c4d
lea eax, [ebp - 0xc0]
push eax
call fcn.00457cb0
cmp eax, dword [ebp + 0x6c]
pop ecx
ja 0x424c4a
lea eax, [ebp - 0xc0]
push eax
push dword [ebp + 0x5c]
call fcn.00457a80
cmp byte [ebp - 0x148], 0
pop ecx
pop ecx
lea edi, [ebp - 0x148]
je 0x424c33
movsx eax, byte [edi]
push eax
call fcn.00442990
cmp eax, 0x4f
pop ecx
jg 0x424b92
je 0x424b58
sub eax, 0x2b
je 0x424b50
push 2
pop ecx
sub eax, ecx
je 0x424b49
sub eax, 0x14
je 0x424b13
sub eax, 7
je 0x424ade
sub eax, 6
jne 0x424c29
cmp esi, 1
jne 0x424ab5
or byte [ebp - 0xec], 0x80
jmp 0x424c29
cmp esi, 2
jne 0x424ac6
and byte [ebp - 0xec], 0x7f
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 0x80
jmp 0x424c29
cmp esi, 1
jne 0x424aee
or dword [ebp - 0xec], ecx
jmp 0x424c29
cmp esi, ecx
jne 0x424afe
and dword [ebp - 0xec], 0xfffffffd
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 2
jmp 0x424c29
cmp esi, 1
jne 0x424b24
or dword [ebp - 0xec], 0x20
jmp 0x424c29
cmp esi, ecx
jne 0x424b34
and dword [ebp - 0xec], 0xffffffdf
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 0x20
jmp 0x424c29
mov esi, ecx
jmp 0x424c29
xor esi, esi
inc esi
jmp 0x424c29
cmp esi, 1
jne 0x424b69
or byte [ebp - 0xeb], 0x10
jmp 0x424c29
cmp esi, 2
jne 0x424b7a
and byte [ebp - 0xeb], 0xef
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 0x1000
jmp 0x424c29
sub eax, 0x52
je 0x424c02
dec eax
je 0x424bd8
dec eax
je 0x424bab
sub eax, 0xa
jne 0x424c29
push 3
pop esi
jmp 0x424c29
cmp esi, 1
jne 0x424bb9
or byte [ebp - 0xeb], 1
jmp 0x424c29
cmp esi, 2
jne 0x424bc7
and byte [ebp - 0xeb], 0xfe
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 0x100
jmp 0x424c29
cmp esi, 1
jne 0x424be6
or dword [ebp - 0xec], 4
jmp 0x424c29
cmp esi, 2
jne 0x424bf4
and dword [ebp - 0xec], 0xfffffffb
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 4
jmp 0x424c29
cmp esi, 1
jne 0x424c0f
or dword [ebp - 0xec], esi
jmp 0x424c29
cmp esi, 2
jne 0x424c1d
and dword [ebp - 0xec], 0xfffffffe
jmp 0x424c29
cmp esi, 3
jne 0x424c29
xor dword [ebp - 0xec], 1
inc edi
cmp byte [edi], 0
jne 0x424a64
push dword [ebp - 0xec]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
jne 0x424c4d
inc dword [ebp + 0x70]
lea eax, [ebp - 0xec]
push eax
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x424999
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x78], 0
je 0x424d95
cmp dword [ebp + 0x6c], 2
jbe 0x424d95
push 0x45cadc
push dword [ebp + 0x5c]
call fcn.00457a80
pop ecx
pop ecx
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x24c]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x424d95
push dword [ebp + 0x60]
call fcn.00457cb0
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop ecx
mov edi, eax
call ebx
sub eax, dword [0x4681ac]
mov ecx, dword [0x465108]
cmp eax, dword [ecx + 0xb0]
jbe 0x424cfc
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x424cf5
push 1
push 0xffffffffffffffff
call fcn.0040de6e
pop ecx
pop ecx
call ebx
mov dword [0x4681ac], eax
test byte [ebp - 0xec], 0x10
je 0x424d78
cmp byte [ebp - 0xc0], 0x2e
jne 0x424d29
cmp byte [ebp - 0xbf], 0
je 0x424d78
cmp byte [ebp - 0xbf], 0x2e
jne 0x424d29
cmp byte [ebp - 0xbe], 0
je 0x424d78
lea eax, [ebp - 0xc0]
push eax
call fcn.00457cb0
add eax, edi
cmp eax, dword [ebp + 0x6c]
pop ecx
jae 0x424d78
push dword [ebp + 0x60]
lea eax, [ebp - 0xc0]
push eax
push 0x45c4ec
push dword [ebp + 0x5c]
call fcn.0040a7af
mov ecx, dword [ebp + 0x54]
add esp, 0x10
push 1
push dword [ebp + 0x78]
lea eax, [ebp - 0x24c]
push dword [ebp + 0x74]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00424873
add dword [ebp + 0x70], eax
lea eax, [ebp - 0xec]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x424cbd
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x7c], 0
jne 0x424dae
mov eax, dword [ebp + 0x70]
mov ecx, dword [0x467b78]
cdq
push 0x18
push edx
push eax
call fcn.00401c1f
mov eax, dword [ebp + 0x70]
pop edi
pop esi
pop ebx
add ebp, 0x64
leave
ret 0x14