Function at 0x100030b0
Capabilities:
Check for time delay via gettickcount
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [0x10028100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x416]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x418], ax
call fcn.10011ef0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xa2e]
xor edx, edx
push edi
push eax
mov word [ebp - 0xa30], dx
call fcn.10011ef0
add esp, 0xc
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x210], cx
call fcn.10011ef0
add esp, 0xc
push 0x206
lea ecx, [ebp - 0x61e]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x620], ax
call fcn.10011ef0
add esp, 0xc
push 0x206
lea eax, [ebp - 0x826]
xor edx, edx
push edi
push eax
mov word [ebp - 0x828], dx
call fcn.10011ef0
add esp, 0xc
push 0x206
lea edx, [ebp - 0xc36]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0xc38], cx
call fcn.10011ef0
add esp, 0xc
push str.bakrdgv3.sys
call fcn.10001030
push eax
push 0x100230a8
lea eax, [ebp - 0x418]
push 0x103
push eax
call fcn.100081a0
add esp, 0x14
push str.bakwdgsvr.sys
call fcn.10001030
push eax
push 0x100230a8
lea ecx, [ebp - 0xa30]
push 0x103
push ecx
call fcn.100081a0
add esp, 0x14
push str.winrdgv3.exe
push ecx
call fcn.10001120
add esp, 4
push eax
push 0x100230a8
lea edx, [ebp - 0x210]
push 0x103
push edx
call fcn.100081a0
add esp, 0x14
push str.winrdgv3.dat
push ecx
call fcn.10001120
add esp, 4
push eax
push 0x100230a8
lea eax, [ebp - 0x620]
push 0x103
push eax
call fcn.100081a0
add esp, 0x14
push str.winrdgv3.dat
push ecx
call fcn.10001120
add esp, 4
push eax
push str._s__s
lea ecx, [ebp - 0x828]
push 0x103
push ecx
call fcn.100081a0
add esp, 0x14
push str.winwdgsvr.exe
push ecx
call fcn.10001120
add esp, 4
push eax
push 0x100230a8
lea edx, [ebp - 0xc38]
push 0x103
push edx
call fcn.100081a0
add esp, 0x14
cmp dword [0x1002cbe8], edi
je 0x10003285
push str.CheckStartupFiles_1
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1002cb40]
cmp ecx, edi
je 0x100032a7
cmp eax, ecx
jb 0x100032a7
add ecx, 0xea60
cmp eax, ecx
jbe 0x10003513
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0x210]
lea ecx, [ebp - 0x418]
mov dword [ebp - 0xc3c], edi
call fcn.10002390
mov esi, dword [ebp - 0xc3c]
add esp, 4
cmp dword [0x1002cbe8], edi
je 0x100032f1
push esi
push str.CheckStartupFiles_2___d_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
mov dword [ebp - 0xc3c], edi
cmp esi, edi
jne 0x10003318
lea ecx, [ebp - 0x210]
push ecx
lea edi, [ebp - 0xc3c]
call fcn.10002c20
add esp, 4
test eax, eax
jne 0x10003508
cmp dword [0x1002cbe8], 0
je 0x1000333b
push str.CheckStartupFiles_3
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
mov eax, dword [ebx + 0x14]
cmp eax, 0xffffffff
je 0x10003351
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x14], 0xffffffff
lea esi, [ebp - 0x210]
lea ecx, [ebp - 0x418]
call fcn.10001f10
mov edi, 1
test eax, eax
jne 0x1000349d
cmp dword [0x1002cbe8], eax
je 0x10003391
push str.CheckStartupFiles_4
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100034c3
cmp dword [0x1002cbe8], 0
je 0x100033dd
push str.CheckStartupFiles_5
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
lea esi, [ebp - 0x210]
lea ecx, [ebp - 0x418]
call fcn.10001f10
test eax, eax
je 0x1000341d
cmp dword [0x1002cbe8], 0
je 0x10003415
push str.CheckStartupFiles_6
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
mov dword [ebx + 0x10], edi
jmp 0x100034c3
call fcn.10007220
test eax, eax
je 0x100034c3
cmp dword [0x1002cbe8], 0
je 0x1000344d
push str.CheckStartupFiles_7
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
lea esi, [ebp - 0x828]
lea ecx, [ebp - 0x418]
call fcn.10001f10
test eax, eax
je 0x100034c3
cmp dword [0x1002cbe8], 0
je 0x10003485
push str.CheckStartupFiles_8
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
push 5
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x100034c3
mov dword [ebx + 0x10], edi
cmp dword [0x1002cbe8], 0
je 0x100034c3
push str.CheckStartupFiles_9
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
push 0
push 0x80
push 3
push 0
push edi
push 0x80000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x14], eax
cmp dword [0x1002cbe8], 0
je 0x10003508
push eax
push str.CheckStartupFiles_10___08x_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1002cb40], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10007ab0
mov esp, ebp
pop ebp
ret