Function at 0x48a0f4
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x48a0fc
push ecx
push ebx
push esi
push edi
mov byte [ebp - 0xd], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x48a481
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 0x374], 0x63
jle 0x48a16b
mov eax, dword [ebx + 0x360]
mov eax, dword [eax + 0x68]
mov edx, 0xff
call fcn.00420728
mov eax, dword [ebx + 0x360]
mov esi, dword [eax + 0x68]
mov eax, esi
call fcn.00420ab0
mov edx, eax
or dl, byte [0x48a490]
mov eax, esi
call fcn.00420abc
mov edx, 0x48a49c
mov eax, dword [ebx + 0x360]
call fcn.0043d72c
jmp 0x48a44c
mov edx, dword [ebx + 0x378]
mov eax, 1
call fcn.0048aa74
test al, al
je 0x48a440
mov eax, dword [0x492e54]
mov eax, dword [eax + 0x370]
call fcn.0048a8c8
push eax
mov eax, dword [0x48dcd8]
mov ecx, 2
mov edx, 1
call fcn.0045e808
lea eax, [ebp - 4]
call fcn.00404880
call sub.kernel32.dll_GetTickCount
mov esi, eax
lea ecx, [ebp - 0x21]
mov eax, dword [0x48dd20]
mov edx, 0x32
call fcn.0045e860
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0xbb8
ja 0x48a1dd
cmp byte [ebp - 0x21], 0
jne 0x48a1b7
mov eax, dword [0x48dd20]
cmp byte [eax + 1], 2
jne 0x48a1ec
mov byte [ebp - 0x21], 1
cmp byte [ebp - 0x21], 0
je 0x48a204
lea eax, [ebp - 4]
mov edx, 0x48a4c8
call fcn.00404918
jmp 0x48a2f1
lea eax, [ebp - 4]
call fcn.00404880
cmp byte [ebp - 0xd], 0
jne 0x48a244
mov edi, 5
mov esi, dword [0x48dd20]
add esi, 2
lea ecx, [ebp - 0x28]
movzx eax, byte [esi]
mov edx, 2
call fcn.00408b20
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.00404b4c
inc esi
dec edi
jne 0x48a220
jmp 0x48a2f1
mov eax, dword [0x48dd20]
movzx eax, byte [eax + 2]
shl eax, 8
mov edx, dword [0x48dd20]
movzx edx, byte [edx + 3]
add eax, edx
lea edx, [ebp - 4]
call fcn.00408a0c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0
mov edi, 0xfffffffb
mov esi, dword [0x48dd20]
add esi, 8
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
movzx eax, byte [esi]
movzx eax, al
xor edx, edx
call fcn.00405894
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00405894
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
dec esi
inc edi
jne 0x48a28e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x10
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x48a4d4
call fcn.00409828
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00404b4c
lea eax, [ebp - 8]
call fcn.00404880
lea eax, [ebp - 0x38]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d78
mov eax, dword [ebp - 0x38]
mov edx, 0x48a4e4
call fcn.00404ca8
jne 0x48a377
mov edi, dword [ebp - 4]
mov esi, edi
test esi, esi
je 0x48a32c
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00404d78
mov esi, edi
test esi, esi
je 0x48a34d
sub esi, 4
mov esi, dword [esi]
lea ecx, [ebp - 0x3c]
mov edx, esi
sub edx, 2
mov eax, dword [ebp - 8]
call fcn.0048a9b0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00404ca8
jne 0x48a377
lea eax, [ebp - 4]
mov edx, 0x48a4f0
call fcn.00404918
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004088a0
cmp dword [ebp - 0x40], 0
je 0x48a437
mov dl, 1
mov eax, dword [0x413014]
call fcn.00403a04
mov esi, eax
cmp byte [ebx + 0x36a], 0
je 0x48a3ee
mov eax, dword [ebx + 0x36c]
call fcn.00408ef8
test al, al
je 0x48a3bf
mov edx, dword [ebx + 0x36c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004088a0
mov edx, dword [ebp - 0x44]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x48a423
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004088a0
mov edx, dword [ebp - 0x48]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x48a423
mov eax, dword [ebx + 0x36c]
call fcn.00408ef8
test al, al
je 0x48a40e
mov eax, dword [ebx + 0x36c]
call fcn.00404d10
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
call fcn.004088a0
mov edx, dword [ebp - 0x4c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebx + 0x36c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.00403a34
xor edx, edx
xor eax, eax
call fcn.0048aa74
mov eax, dword [0x48ddcc]
mov eax, dword [eax]
call fcn.0045c378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a488
lea eax, [ebp - 0x4c]
mov edx, 6
call fcn.004048a4
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004048a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048a4
ret