Function at 0x4aa500
Capabilities:
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53155f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x318
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x20], eax
mov edx, 0x54a6ac
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x30], 0x203e2d20
mov byte [ebp - 0x2c], al
call fcn.00459050
push eax
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x5244425b
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x24], 0x494e4945
mov dword [ebp - 0x20], 0x3a205d54
mov word [ebp - 0x1c], 0x203a
mov byte [ebp - 0x1a], 0
call fcn.00459130
add esp, 4
lea ecx, [ebp - 0x30]
mov edx, eax
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00459280
add esp, 4
mov dword [ebp - 0x30], 0x202d3c20
mov edx, 0x54a6ac
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x138]
call fcn.00459050
push eax
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x5244425b
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x24], 0x494e4945
mov dword [ebp - 0x20], 0x3a205d54
mov word [ebp - 0x1c], 0x203a
mov byte [ebp - 0x1a], 0
call fcn.00459130
add esp, 4
lea ecx, [ebp - 0x30]
mov edx, eax
push ecx
lea ecx, [ebp - 0x16c]
call fcn.00459280
add esp, 4
call fcn.00441aa0
mov esi, eax
mov dword [ebp - 0x2c0], 0
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x16c]
movlpd qword [ebp - 0x2d0], xmm0
mov dword [ebp - 0x2c8], eax
mov ecx, dword [esi]
mov dword [ebp - 0x2c4], esi
cmp dword [ecx], 0
je 0x4aa687
lea eax, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
push 0x546f10
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x1a0]
push eax
push str._s_s
push 0x546f10
push 0
push esi
mov dword [ebp - 0x2cc], ecx
call fcn.0043d760
add esp, 0x18
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004a8b40
mov byte [ebp - 4], 1
call fcn.00441aa0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4aa796
lea eax, [ebp - 0x104]
push eax
call fcn.004aad50
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x20], 1
jb 0x4aa6cf
mov eax, dword [eax]
mov dword [ebp - 0x2b8], eax
lea edx, [ebp - 0x2b8]
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x70]
call fcn.0041ebd0
add esp, 4
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x58]
push eax
mov dword [ebp - 0x20], 3
call fcn.00444e70
mov dword [ebp - 4], 4
lea edi, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x1e0]
mov eax, 0xf
mov dword [ebp - 0x40], 0x290028
cmovae edi, dword [ebp - 0x58]
mov edx, str.CReinitProcess::RestartProcess
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0x2d0020
mov dword [ebp - 0x38], 0x20
call fcn.004194d0
mov edx, str._BDREINIT__::
lea ecx, [ebp - 0x138]
mov esi, eax
call fcn.00419450
push esi
mov edx, eax
lea ecx, [ebp - 0xe8]
call fcn.004195d0
add esp, 4
lea ecx, [ebp - 0x40]
mov edx, eax
push ecx
lea ecx, [ebp - 0x248]
call fcn.00419770
add esp, 4
mov esi, eax
call fcn.00441aa0
push edi
push 0
push esi
push 0
push eax
call fcn.0043ebb0
add esp, 0x14
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x2b8]
test al, 4
je 0x4aa804
mov edx, dword [ebp - 0x44]
and eax, 0xfffffffb
mov dword [ebp - 0x2b8], eax
cmp edx, 8
jb 0x4aa7f0
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa7e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad1d
push edx
push ecx
call fcn.004fc7e0
mov eax, dword [ebp - 0x2b8]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], cx
mov dword [ebp - 4], 2
test al, 2
je 0x4aa86c
mov edx, dword [ebp - 0x5c]
and eax, 0xfffffffd
mov dword [ebp - 0x2b8], eax
cmp edx, 8
jb 0x4aa858
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa848
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad1d
push edx
push ecx
call fcn.004fc7e0
mov eax, dword [ebp - 0x2b8]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], cx
mov dword [ebp - 4], 1
test al, 1
je 0x4aa8b7
mov edx, dword [ebp - 0xf0]
cmp edx, 8
jb 0x4aa8b7
mov ecx, dword [ebp - 0x104]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aa8ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad1d
push edx
push ecx
call fcn.004fc7e0
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x2e0], xmm0
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
push ecx
cmovae eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x328]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x324], xmm0
movlpd qword [ebp - 0x31c], xmm0
movlpd qword [ebp - 0x314], xmm0
movlpd qword [ebp - 0x30c], xmm0
movlpd qword [ebp - 0x304], xmm0
movlpd qword [ebp - 0x2fc], xmm0
movlpd qword [ebp - 0x2f4], xmm0
movlpd qword [ebp - 0x2ec], xmm0
mov dword [ebp - 0x328], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4aabdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0xd8]
xor eax, eax
mov dword [ebp - 0xd8], 0x80728045
lea ecx, [ebp - 0x70]
mov dword [ebp - 0xd4], 0x806f8072
mov dword [ebp - 0xd0], 0x802c8072
mov dword [ebp - 0xcc], 0x80638020
mov dword [ebp - 0xc8], 0x806c8061
mov dword [ebp - 0xc4], 0x8069806c
mov dword [ebp - 0xc0], 0x8067806e
mov dword [ebp - 0xbc], 0x80438020
mov dword [ebp - 0xb8], 0x80658072
mov dword [ebp - 0xb4], 0x80748061
mov dword [ebp - 0xb0], 0x80508065
mov dword [ebp - 0xac], 0x806f8072
mov dword [ebp - 0xa8], 0x80658063
mov dword [ebp - 0xa4], 0x80738073
mov dword [ebp - 0xa0], 0x803a8057
mov dword [ebp - 0x9c], 0x807b8020
mov dword [ebp - 0x98], 0x8000807d
mov word [ebp - 0x94], ax
call fcn.00419a70
mov byte [ebp - 4], 6
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x104]
cmovae eax, dword [ebp - 0x70]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041d930
add esp, 4
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 7
call fcn.00444e70
mov byte [ebp - 4], 8
lea edi, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x1e0]
mov edx, str.CReinitProcess::RestartProcess
mov dword [ebp - 0x40], 0x290028
cmovae edi, dword [ebp - 0x58]
mov dword [ebp - 0x3c], 0x2d0020
mov dword [ebp - 0x38], 0x20
call fcn.004194d0
mov edx, str._BDREINIT__::
lea ecx, [ebp - 0x138]
mov esi, eax
call fcn.00419450
push esi
mov edx, eax
lea ecx, [ebp - 0x240]
call fcn.004195d0
add esp, 4
lea ecx, [ebp - 0x40]
mov edx, eax
push ecx
lea ecx, [ebp - 0x2b0]
call fcn.00419770
add esp, 4
mov esi, eax
call fcn.00441aa0
push edi
push 0
push esi
push 8
push eax
call fcn.0043ebb0
mov byte [ebp - 4], 7
add esp, 0x14
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x4aab0e
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aab04
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad22
push edx
push ecx
call fcn.004fc7e0
add esp, 8
xor eax, eax
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xf0]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
cmp edx, 8
jb 0x4aab66
mov ecx, dword [ebp - 0x104]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aab5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad22
push edx
push ecx
call fcn.004fc7e0
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 7
mov word [ebp - 0x104], ax
cmp edx, 8
jb 0x4aabc1
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aabb7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad22
push edx
push ecx
call fcn.004fc7e0
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov byte [ebp - 0x2b1], al
jmp 0x4aabe4
mov byte [ebp - 0x2b1], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2e0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4aac06
push eax
call esi
mov ecx, dword [ebx + 4]
test eax, eax
je 0x4aad27
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x4aac1e
push eax
call esi
mov ecx, dword [ebx + 4]
test eax, eax
je 0x4aad32
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x4aac5f
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4aac55
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aad3d
push edx
push ecx
call fcn.004fc7e0
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov dword [ebp - 4], 9
mov edi, dword [ebp - 0x30]
mov eax, dword [edi]
cmp dword [eax], 0
je 0x4aacf9
mov esi, dword [0x56b120]
lea eax, [ebp - 0x40]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x3c]
sbb edx, dword [ebp - 0x2cc]
call fcn.00525570
mov edx, dword [esi + 4]
mov ecx, dword [esi]
movsd qword [ebp - 0x40], xmm0
call fcn.00525570
movsd xmm1, qword [ebp - 0x40]
lea eax, [ebp - 0x16c]
divsd xmm1, xmm0
sub esp, 8
cvtpd2ps xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x546f10
push str._s_n____.6f___
push eax
push 0
push edi
call fcn.0043d760
add esp, 0x1c
mov al, byte [ebp - 0x2b1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fc7af
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
call fcn.0050175f
call fcn.0050175f
push ecx
mov edx, 0x942
call fcn.00452090
push ecx
mov edx, 0x942
call fcn.00452090
call fcn.0050175f
int3