Function at 0x478c70
Capabilities:
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x4c4b04], 0
je 0x478cce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c4b08]
cmp eax, 0x3e8
jae 0x478cb8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push dword [0x4c4b04]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x478cb8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push dword [0x4c4b04]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [0x4c4b04], 0
push ebx
call fcn.00479900
mov ebx, eax
mov dword [ebp - 0x1c], 0
mov eax, 0x5a4d
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0
cmp word [ebx], ax
je 0x478cf8
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x478d16
cmp dword [esi], 0x4550
je 0x478d1e
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x20b
mov ecx, 0x108
cmp word [esi + 0x18], dx
mov eax, 0xf8
movzx edx, word [esi + 6]
cmove eax, ecx
xor ecx, ecx
add eax, esi
push edi
test edx, edx
je 0x478d58
cmp dword [eax + 0x14], 0
je 0x478d50
test dword [eax + 0x24], 0x20000020
jne 0x478d61
inc ecx
add eax, 0x28
cmp ecx, edx
jl 0x478d41
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test edi, edi
je 0x478d58
xor ecx, ecx
lea eax, [edi + 3]
shr eax, 2
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc140.dll_Ordinal_265
push edi
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0x10
cmp edx, dword [esi + 0x34]
je 0x478e53
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x478e53
cmp dword [eax + edx], 0
lea ebx, [eax + edx]
je 0x478e53
lea eax, [ebx + 4]
xor esi, esi
mov dword [ebp - 0xc], eax
lea edi, [ebx + 8]
mov eax, dword [eax]
sub eax, 8
test eax, 0xfffffffe
jbe 0x478e42
nop dword [eax]
movzx ecx, word [edi]
mov eax, ecx
and eax, 0xfff
add eax, dword [ebx]
add eax, edx
mov edx, eax
sub edx, dword [ebp - 8]
js 0x478e2d
cmp edx, dword [ebp - 0x10]
jae 0x478e2d
shr ecx, 0xc
test ecx, ecx
je 0x478e2d
cmp ecx, 3
je 0x478e1c
push 0
push str.Error
push 0x4a4f58
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x478e2d
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
add eax, dword [ecx + 0x34]
mov ecx, dword [ebp - 0x14]
mov dword [edx + ecx], eax
mov eax, dword [ebp - 0xc]
inc esi
mov edx, dword [ebp - 4]
add edi, 2
mov eax, dword [eax]
sub eax, 8
shr eax, 1
cmp esi, eax
jb 0x478de0
mov eax, dword [ebp - 0xc]
add ebx, dword [eax]
cmp dword [ebx], 0
jne 0x478dc6
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
push ebx
push edi
mov eax, dword [ecx]
call dword [eax + 0x10]
push ebx
mov esi, eax
call sub.mfc140.dll_Ordinal_266
add esp, 4
push 0x4c4b04
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [0x4c4b08], eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret