Function at 0x1801c3478
Capabilities:
Check for time delay via gettickcount
Create directory
Delete directory
Get common file path
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x18028c330]
mov qword [rbp + 0x220], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rsp + 0x20], xmm0
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea r12d, [rax + 0xf]
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x20], r14b
movups xmmword [rsp + 0x40], xmm0
movdqa xmm6, xmmword [0x1802581e0]
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], r14b
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], r14b
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], r14b
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rax, [rbp - 0x40]
or rsi, 0xffffffffffffffff
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], r14b
jne 0x1801c352b
cmp rdi, qword [rsp + 0x38]
ja 0x1801c3565
lea rbx, [rsp + 0x20]
cmp qword [rsp + 0x38], r12
cmova rbx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rdi
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1801dd380
mov byte [rbx + rdi], r14b
jmp 0x1801c3576
lea r9, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180003a7c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
lea rdx, [rbp + 0xd0]
call fcn.1801c3af4
inc rsi
cmp byte [rax + rsi], r14b
jne 0x1801c358a
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800038d8
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], r12
cmova rcx, qword [rsp + 0x20]
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r15, qword [rsp + 0x30]
lea r13, [rsp + 0x20]
cmp qword [rsp + 0x38], r12
cmova r13, qword [rsp + 0x20]
movabs rdi, 0x7fffffffffffffff
movabs r14, 0x8000000000000000
mov r12, qword [rsp + 0x58]
cmp r15, r12
ja 0x1801c361c
lea rbx, [rsp + 0x40]
cmp r12, 0xf
cmova rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], r15
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1801dd380
mov byte [rbx + r15], 0
jmp 0x1801c36d6
cmp r15, rdi
ja 0x1801c3acd
mov rbx, r15
or rbx, 0xf
cmp rbx, rdi
ja 0x1801c3642
mov rcx, r12
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r12, rax
jbe 0x1801c364a
mov rbx, rdi
mov rcx, r14
jmp 0x1801c366b
lea rax, [r12 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1801c3662
xor esi, esi
jmp 0x1801c367a
cmp rcx, 0x1000
jb 0x1801c3672
call fcn.180002b58
jmp 0x1801c3677
call fcn.180016874
mov rsi, rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
mov r8, r15
mov rdx, r13
mov rcx, rsi
call fcn.1801dd380
mov byte [rsi + r15], 0
cmp r12, 0xf
jbe 0x1801c36d1
lea rdx, [r12 + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801c36cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ad3
call fcn.180014dbc
mov qword [rsp + 0x40], rsi
mov r8d, 6
lea rdx, str....._
lea rcx, [rsp + 0x40]
call fcn.1800038d8
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov r15, qword [rsp + 0x30]
lea r13, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova r13, qword [rsp + 0x20]
mov r12, qword [rbp - 0x68]
cmp r15, r12
ja 0x1801c3752
lea rbx, [rbp - 0x80]
cmp r12, 0xf
cmova rbx, qword [rbp - 0x80]
mov qword [rbp - 0x70], r15
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1801dd380
xor r13d, r13d
mov byte [rbx + r15], r13b
jmp 0x1801c380a
cmp r15, rdi
ja 0x1801c3acd
mov rbx, r15
or rbx, 0xf
cmp rbx, rdi
ja 0x1801c3778
mov rcx, r12
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp r12, rax
jbe 0x1801c3780
mov rbx, rdi
mov rcx, r14
jmp 0x1801c37a1
lea rax, [r12 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1801c3798
xor esi, esi
jmp 0x1801c37b0
cmp rcx, 0x1000
jb 0x1801c37a8
call fcn.180002b58
jmp 0x1801c37ad
call fcn.180016874
mov rsi, rax
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rbx
mov r8, r15
mov rdx, r13
mov rcx, rsi
call fcn.1801dd380
xor r13d, r13d
mov byte [rsi + r15], r13b
cmp r12, 0xf
jbe 0x1801c3806
lea rdx, [r12 + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801c3801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ad3
call fcn.180014dbc
mov qword [rbp - 0x80], rsi
mov r8d, 0x13
lea rdx, str.....TemporaryFile
lea rcx, [rbp - 0x80]
call fcn.1800038d8
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rsi, qword [rsp + 0x30]
lea r12, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x78]
cmp rsi, r15
ja 0x1801c3886
lea rbx, [rsp + 0x60]
cmp r15, 0xf
cmova rbx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rsi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.1801dd380
mov byte [rsi + rbx], r13b
jmp 0x1801c3948
cmp rsi, rdi
ja 0x1801c3acd
mov rcx, rsi
or rcx, 0xf
cmp rcx, rdi
ja 0x1801c38d1
mov rdx, r15
shr rdx, 1
mov rax, rdi
sub rax, rdx
cmp r15, rax
ja 0x1801c38d1
lea rax, [r15 + rdx]
mov rdi, rcx
cmp rcx, rax
cmovb rdi, rax
lea r14, [rdi + 1]
test r14, r14
jne 0x1801c38c8
mov rbx, r13
jmp 0x1801c38e6
cmp r14, 0x1000
jb 0x1801c38db
mov rcx, r14
call fcn.180002b58
jmp 0x1801c38e3
mov rcx, r14
call fcn.180016874
mov rbx, rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.1801dd380
mov byte [rbx + rsi], r13b
cmp r15, 0xf
jbe 0x1801c3943
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
mov edi, 0x1000
cmp rdx, rdi
jb 0x1801c3937
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ad3
call fcn.180014dbc
mov qword [rsp + 0x60], rbx
jmp 0x1801c394d
mov qword [rsp + 0x60], rbx
mov edi, 0x1000
mov r8d, 0xe
lea rdx, str.TemporaryFile
lea rcx, [rsp + 0x60]
call fcn.1800038d8
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1801c39dd
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rdi
jb 0x1801c39d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ad9
call fcn.180014dbc
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], r13b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1801c3a1f
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rdi
jb 0x1801c3a1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3adf
call fcn.180014dbc
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], r13b
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1801c3a61
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rdi
jb 0x1801c3a5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ae5
call fcn.180014dbc
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], r13b
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1801c3aa1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rdi
jb 0x1801c3a9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801c3ac7
call fcn.180014dbc
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18019c4a8
nop
call fcn.1800029c8
nop
call fcn.18019c4a8
nop
call fcn.18019c4a8
nop
call fcn.18019c4a8
nop
call fcn.18019c4a8
int3