Function at 0x436c88
Capabilities:
Check for time delay via gettickcount
Check if file exists

Disassembly:
push 0x3c4
mov eax, 0x4a82ac
call fcn.0049cbc1
mov ebx, ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x271], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor edi, edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], edi
mov byte [ebp - 0x272], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [ebp - 0x26c]
push eax
mov byte [ebp - 4], 1
call fcn.004814b2
lea esi, [ebx + 8]
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
mov dword [ebp - 0x280], esi
call fcn.00481570
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x30]
call dword [0x4aa370]
mov eax, dword [ebp - 0x260]
cmp eax, edi
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x27c], ecx
jg 0x436d2e
jl 0x436d1f
cmp ecx, 0x1400000
jae 0x436d2e
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
call dword [0x4aa370]
jmp 0x436d82
mov dword [ebp - 0xcc], vtable.KMD5.0
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov byte [ebp - 4], 3
cmp dword [esi + 0x18], 8
jb 0x436d4d
mov eax, dword [esi + 4]
jmp 0x436d50
lea eax, [esi + 4]
push eax
lea edi, [ebp - 0xcc]
call fcn.0048361f
test eax, eax
je 0x436d73
call fcn.004836d5
test eax, eax
je 0x436d73
push eax
lea ecx, [ebp - 0x4c]
call dword [0x4aa3c4]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.004835f5
cmp dword [esi + 0x18], 8
jb 0x436d8d
mov esi, dword [esi + 4]
jmp 0x436d90
add esi, 4
push esi
push 0x4e08b8
call fcn.004841e4
push eax
lea esi, [ebp - 0x3d0]
call fcn.00427e99
mov byte [ebp - 4], 4
push dword [eax]
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x3cc]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x3d0], eax
je 0x436dd5
push dword [ebp - 0x3d0]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea esi, [ebx + 0x30]
push esi
mov dword [ebp - 0x270], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebx + 0x50]
mov dword [ebp - 0x28c], eax
mov dword [eax], 0xa
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebx + 0x15c]
call dword [0x4aa370]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebx + 0x178]
call dword [0x4aa370]
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebx + 0x1a0]
call dword [0x4aa370]
mov eax, dword [ebp - 0x284]
mov dword [ebx + 0x194], eax
mov eax, dword [ebp - 0x27c]
push esi
mov dword [ebx + 0x198], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x280]
cmp dword [edi + 0x18], 8
jb 0x436e54
mov eax, dword [edi + 4]
jmp 0x436e57
lea eax, [edi + 4]
lea ecx, [ebp - 0x2b0]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x436f20
mov eax, dword [ebp - 0x290]
mov dword [ebx + 0x1e8], eax
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x29c]
lea eax, [ebp - 0x278]
push dword [ebp - 0x298]
push str._x_x
push eax
call fcn.00408085
add esp, 0x10
cmp dword [ebx + 0x204], 0
jne 0x436ed2
push dword [ebp - 0x278]
lea ecx, [ebx + 0x1f0]
call dword [0x4aa3c4]
jmp 0x436f0e
lea esi, [ebx + 0x1f0]
cmp dword [esi + 0x18], 8
jb 0x436ee3
mov eax, dword [esi + 4]
jmp 0x436ee6
lea eax, [esi + 4]
push dword [ebp - 0x278]
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x436f07
push dword [ebp - 0x278]
mov ecx, esi
call dword [0x4aa3c4]
mov ecx, ebx
call fcn.004369af
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
call fcn.00401291
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x271]
push eax
push 0
mov ecx, ebx
call fcn.00437d2d
cmp eax, 3
mov dword [ebp - 0x278], eax
je 0x436f5a
cmp eax, 2
jne 0x436f82
lea eax, [ebp - 0x271]
push eax
push 0
mov ecx, ebx
call fcn.00437d2d
cmp eax, 3
mov dword [ebp - 0x278], eax
je 0x43754d
cmp eax, 2
je 0x43754d
mov ecx, ebx
call fcn.004390a5
call esi
push dword [ebp - 0x270]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x278], 0
push dword [ebp - 0x270]
jne 0x436fc6
sub esi, dword [ebp - 0x284]
mov byte [ebx + 0x1c0], 1
mov dword [ebx + 0x19c], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4373a9
mov esi, dword [ebp - 0x28c]
mov dword [esi], 0x1e
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
push 0x64
pop eax
sub eax, dword [esi]
test eax, eax
jle 0x437005
push eax
push 0x64
push 0x64
push esi
push 0xa
pop edi
mov esi, ebx
call fcn.00438939
mov edi, dword [ebp - 0x280]
jmp 0x437007
mov al, 1
test al, al
jne 0x437017
mov byte [ebp - 0x272], 1
jmp 0x4373a0
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x270]
mov dword [ebx + 0x48], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
cmp byte [ebp - 0x271], 0
jne 0x437086
push 0x64
lea ecx, [ebx + 0x68]
pop eax
sub eax, dword [ecx]
test eax, eax
jle 0x43706c
push eax
push 0xc8
push 0x64
push ecx
push 0xa
pop edi
mov esi, ebx
call fcn.00438939
jmp 0x43706e
mov al, 1
test al, al
je 0x43700b
mov ecx, dword [ebx + 0x1e8]
push 3
push 0
call fcn.004389cd
jmp 0x437192
lea esi, [ebp - 0x14c]
call fcn.00439419
lea eax, [ebp - 0x288]
push eax
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 8
call fcn.0043986c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [edi + 0x18], 8
mov esi, eax
jb 0x4370b8
mov ecx, dword [edi + 4]
jmp 0x4370bb
lea ecx, [edi + 4]
mov eax, dword [ebx + 0x1dc]
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x14]
test eax, eax
jge 0x43713f
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
fld qword [0x4bfb40]
push dword [ebp - 0x270]
mov dword [ebx + 0x48], 3
fstp qword [ebx + 0x70]
fldz
and dword [ebx + 0x68], 0
fstp qword [ebx + 0x78]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
push 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x1e8]
sub eax, esi
push eax
call fcn.004389cd
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 6
push eax
mov dword [ebp - method.KxEPipeClientT_class_IKxEScanService_.virtual_0], vtable.KxEIPCClientT_class_IKxEScanService__class_KxEPipeClientCommunication_.0
call fcn.00402ba5
jmp 0x43758a
push 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x1e8]
sub eax, esi
push eax
call fcn.004389cd
push 0x190
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 6
mov dword [ebp - method.KxEPipeClientT_class_IKxEScanService_.virtual_0], vtable.KxEIPCClientT_class_IKxEScanService__class_KxEPipeClientCommunication_.0
push eax
jne 0x43718d
mov byte [ebp - 0x272], 1
call fcn.00402ba5
jmp 0x4373a0
call fcn.00402ba5
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x270]
mov dword [ebx + 0x48], 4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x27c], 0x63
xor edi, edi
call esi
mov dword [ebx + 0x210], eax
call esi
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x27c]
push 0xa
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x43725f
xor esi, esi
cmp dword [ebp - 0x27c], esi
push esi
mov ecx, ebx
je 0x4372c8
push 1
call fcn.00437d2d
cmp eax, esi
mov dword [ebp - 0x278], eax
je 0x4372d5
cmp eax, 3
je 0x4373a0
inc edi
cmp edi, 1
jne 0x437239
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebx + 0x48], 5
jmp 0x437251
cmp edi, 2
jne 0x437274
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebx + 0x48], 6
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x437274
push 0x3e8
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4372d5
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
fild dword [ebp - 0x27c]
fld qword [0x4bfba0]
fld st(0)
fsub st(2)
fdiv st(1)
fmulp st(1)
call fcn.0049c9f0
fstp qword [ebx + 0x90]
push dword [ebp - 0x270]
mov dword [ebx + 0x80], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
dec dword [ebp - 0x27c]
jmp 0x4371df
push 2
call fcn.00437d2d
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
je 0x4373a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x214], eax
sub eax, dword [ebx + 0x210]
push eax
call fcn.00438b82
cmp dword [ebx + 0x48], 4
jne 0x43734d
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x270]
mov dword [ebx + 0x48], 5
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
push 0x28
lea ecx, [ebx + 0x80]
pop eax
sub eax, dword [ecx]
test eax, eax
jle 0x43734d
push eax
push 0x190
push 0x28
push ecx
push 2
pop edi
mov esi, ebx
call fcn.00438939
cmp dword [ebx + 0x48], 5
jne 0x4373a0
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x270]
mov dword [ebx + 0x48], 6
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
push 0x64
lea ecx, [ebx + 0x80]
pop eax
sub eax, dword [ecx]
test eax, eax
jle 0x4373a0
push eax
push 0x190
push 0x64
push ecx
push 7
pop edi
mov esi, ebx
call fcn.00438939
cmp dword [ebp - 0x278], 0
jne 0x4373b0
mov ecx, ebx
call fcn.004369af
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 3
pop edi
cmp dword [ebp - 0x278], edi
je 0x437533
cmp byte [ebp - 0x272], 0
jne 0x437533
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x284]
push 8
mov dword [ebx + 0x19c], eax
pop esi
lea eax, [ebp - 0x2cc]
push eax
mov eax, ebx
mov dword [ebx + 0x48], esi
call fcn.004389b1
cmp dword [eax + 0x18], esi
jb 0x437408
mov eax, dword [eax + 4]
jmp 0x43740b
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 0x271], al
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp byte [ebp - 0x271], 0
je 0x437440
and dword [ebx + 0x98], 0
mov dword [ebx + 0x1bc], edi
mov esi, vtable.KxEIPCClientT_class_IKxEPopBox__class_KxEPipeClientCommunication_.0
mov dword [ebp - 0x1cc], esi
call fcn.004298c5
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.00402988
mov dword [ebp - method.KxEIPCClientT_class_IKxEPopBox__class_KxEPipeClientCommunication_.virtual_0], 0x4b8b44
xor eax, eax
mov byte [ebp - 4], 9
and dword [ebp - 0x27c], 0
lea edi, [ebp - 0x288]
stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00439c66
cmp dword [ebp - 0x27c], 0
je 0x43751b
cmp dword [ebx + 0x98], 1
je 0x43751b
cmp dword [ebx + 0x1e4], 0xa
jne 0x43751b
lea eax, [ebp - 0xac]
push eax
call fcn.00433294
mov byte [ebp - 4], 0xa
mov eax, dword [ebx + 0x98]
push dword [ebp - 0x280]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xac], 7
mov dword [ebp - 0xa8], eax
call dword [0x4aa370]
xor eax, eax
lea edi, [ebp - 0x280]
stosd dword es:[edi], eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00439cb4
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 4], 9
call fcn.004332c3
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 6
push eax
mov dword [ebp - 0x1cc], esi
call fcn.00402ba5
jmp 0x43753a
mov dword [ebx + 0x48], 7
mov ecx, dword [ebp - 0x28c]
push 0x64
pop eax
mov dword [ecx], eax
mov dword [ebx + 0x80], eax
jmp 0x43756a
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebx + 0x48], 7
mov dword [ebx + 0x80], 0x64
fldz
push dword [ebp - 0x270]
fstp qword [ebx + 0x90]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x1e0]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [ebp - 0x26c]
push eax
mov byte [ebp - 4], 1
call fcn.0048153f
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
call fcn.0049cc44
ret