Function at 0x401820
Capabilities:
Check for time delay via queryperformancecounter
Check os version
Get system information on windows
Get token membership
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4483d1
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x45a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x288]
mov ecx, 0x4690e3
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x288], 0x462458
call fcn.00447953
push 0x462498
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x4c]
mov dword [0x462490], 0
xorps xmm0, xmm0
push eax
movsd qword [0x4624a8], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov dword [0x46245c], eax
lea eax, [ebp - 0x280]
push eax
push 0
mov dword [ebp - 0x280], 0
call esi
push dword [ebp - 0x280]
call fcn.00430359
add esp, 4
mov edi, eax
lea eax, [ebp - 0x280]
push eax
push edi
call esi
mov edx, dword [ebp - 0x280]
xor ecx, ecx
mov dword [0x462458], ecx
cmp edx, 0x18
jb 0x401905
mov eax, 0x18
nop dword [eax]
cmp dword [eax + edi - 0x14], 0
jne 0x4018fe
inc ecx
mov dword [0x462458], ecx
add eax, 0x18
cmp eax, edx
jbe 0x4018f0
push edi
call fcn.0042a988
add esp, 4
push 0x462460
push 0
push 0
call dword [sym.imp.pdh.dll_PdhOpenQueryA]
mov edi, dword [sym.imp.pdh.dll_PdhAddCounterA]
lea eax, [ebp - 0x284]
push eax
push 0
push str.Processor_Information__Total_Processor_Frequency
push dword [0x462460]
call edi
push dword [0x462460]
mov esi, dword [sym.imp.pdh.dll_PdhCollectQueryData]
call esi
lea eax, [ebp - 0x20]
push eax
push 0
push 0x200
push dword [ebp - 0x284]
call dword [sym.imp.pdh.dll_PdhGetFormattedCounterValue]
movsd xmm0, qword [ebp - 0x18]
push dword [ebp - 0x284]
movsd qword [0x462470], xmm0
call dword [sym.imp.pdh.dll_PdhRemoveCounter]
push 0x462464
push 0
push str.Process_NetScr___Processor_Time
push dword [0x462460]
call edi
push 0x462468
push 0
push str.Processor__Total___Processor_Time
push dword [0x462460]
call edi
push 0x46246c
push 0
push str.Network_Interface__Bytes_Total_sec
push dword [0x462460]
call edi
push dword [0x462460]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x462498
call edi
xorps xmm0, xmm0
mov dword [0x462490], 0
movsd qword [0x4624a8], xmm0
mov dword [ebp - 4], 0
movups xmmword [0x4625e8], xmm0
mov dword [0x4624e8], 0
mov dword [0x4624ec], 0
mov byte [0x462534], 0
movq qword [0x462535], xmm0
mov dword [0x46253d], 0
mov dword [0x462541], 0
movq qword [0x462545], xmm0
mov dword [0x46254d], 0
mov dword [0x462551], 0
mov dword [0x4625f8], 0
mov dword [0x4625fc], 0xf
mov byte [0x4625e8], 0
mov ecx, 0x462610
mov dword [0x462608], 0
call fcn.00413b30
mov ecx, 0x462c88
call fcn.00413b30
mov dword [0x462c88], 0x453324
mov byte [0x463300], 0
mov ecx, 0x463308
call fcn.00413b30
mov dword [0x463308], 0x453504
mov byte [0x463980], 0
mov byte [0x4639b0], 0
push 0x4531f8
push 0x12
push 0
push 0
push 0
push 0x80
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0x28
mov dword [0x463a2c], 0
mov dword [0x463a30], 0
mov dword [0x4639dc], 0
mov dword [0x4639e4], 0
mov dword [0x463a18], 0
mov dword [0x4639d0], 0
mov dword [0x4639cc], 0
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [0x463a28], eax
mov dword [0x4639e8], 0
mov byte [ebp - 4], 5
xorps xmm0, xmm0
push 0x463a78
mov byte [0x463a34], 1
movups xmmword [0x463a38], xmm0
mov dword [0x463a48], 0
mov dword [0x463a57], 0
mov byte [0x463a5b], 0
mov byte [0x463a62], 0
call edi
xorps xmm0, xmm0
mov dword [0x463a70], 0
push 0x463a98
movsd qword [0x463a88], xmm0
call edi
xorps xmm0, xmm0
mov dword [0x463a90], 0
push 0x463ab8
movsd qword [0x463aa8], xmm0
call edi
xorps xmm0, xmm0
mov dword [0x463ab0], 0
push 0x463ad8
movsd qword [0x463ac8], xmm0
call edi
xor eax, eax
mov dword [0x463ad0], 0
xorps xmm0, xmm0
mov word [0x463afa], ax
push 0x10
movsd qword [0x463ae8], xmm0
mov dword [ebp - 0x280], 0x463b00
mov dword [0x463b08], eax
mov dword [ebp - 0x284], 0x463b0c
mov dword [0x463b0c], eax
mov dword [0x463b10], eax
mov dword [0x463b14], eax
call fcn.00421968
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [0x463b10], eax
mov dword [0x463b18], 0
mov dword [0x463b1c], 0
mov dword [0x463b20], 0
mov byte [ebp - 4], 7
mov ecx, 0x463b18
push eax
push 0x10
mov dword [0x463b24], 7
mov dword [0x463b28], 8
mov dword [0x463b0c], 0x3f800000
call fcn.00412690
mov byte [ebp - 4], 8
push 0xc
mov dword [0x463b2c], 0
mov dword [0x463b30], 0
call fcn.00421968
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [0x463b2c], eax
mov dword [0x463b4c], 0
mov dword [0x463b50], 0
mov dword [0x463b54], 0
push 0x463b60
mov byte [ebp - 4], 0xa
call edi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
push 0x463b34
mov dword [0x463b58], 0
movsd qword [0x463b70], xmm0
call esi
mov eax, dword [0x463b54]
sub eax, dword [0x463b4c]
sar eax, 2
mov dword [ebp - 0x284], 0x3e8
cmp eax, 0x3e8
jae 0x401d09
lea eax, [ebp - 0x284]
mov ecx, 0x463b4c
push eax
call fcn.00412840
xorps xmm0, xmm0
mov dword [0x463ba8], 0
movsd qword [0x463bb0], xmm0
movaps xmm0, xmmword [0x453e10]
push 0x463bf8
movups xmmword [0x463bc0], xmm0
mov dword [0x463bd0], 0
mov dword [0x463bd4], 0
call edi
xorps xmm0, xmm0
mov dword [0x463bf0], 0
push 0x463bd8
movsd qword [0x463c08], xmm0
call esi
push 0x402470
push 0x402440
push 3
push 0x40
push 0x463c18
mov byte [ebp - 4], 0xc
call fcn.00421d2f
push 0x402470
push 0x402440
push 3
push 0x40
push 0x463cd8
mov byte [ebp - 4], 0xd
call fcn.00421d2f
push 0x413010
push 0x412fe0
push 3
push 0x2c
push 0x463d98
mov byte [ebp - 4], 0xe
call fcn.00421d2f
xorps xmm0, xmm0
mov dword [0x463e28], 0
movups xmmword [0x463e70], xmm0
mov byte [0x463e2c], 0
mov eax, 0x464048
movups xmmword [0x463eb0], xmm0
mov dword [0x463e48], 0
mov ecx, 0x1e
movups xmmword [0x463ec8], xmm0
mov dword [0x463e4c], 0
movups xmmword [0x463ee0], xmm0
mov dword [0x463e58], 0x45301c
mov dword [0x463e5c], 0x453024
mov dword [0x463e60], 0x45302c
mov dword [0x463e6c], 0
mov dword [0x463e80], 0
mov dword [0x463e84], 0xf
mov byte [0x463e70], 0
mov dword [0x463ec0], 0
mov dword [0x463ec4], 0xf
mov byte [0x463eb0], 0
mov dword [0x463ed8], 0
mov dword [0x463edc], 0xf
mov byte [0x463ec8], 0
mov dword [0x463ef0], 0
mov dword [0x463ef4], 0xf
mov byte [0x463ee0], 0
mov dword [0x463e20], 0x452fec
mov dword [eax + 4], 0
lea eax, [eax + 8]
mov dword [eax - 8], 0
sub ecx, 1
jne 0x401ea3
mov dword [0x463e44], ecx
mov dword [0x463e38], 0x452f94
mov byte [0x463f28], cl
push 0x4641a0
mov word [0x46416c], cx
call edi
xorps xmm0, xmm0
mov dword [0x464198], 0
push 0x4641d8
movsd qword [0x4641b0], xmm0
mov dword [0x4641c8], 0
mov dword [0x4641cc], 0
movups xmmword [0x46420c], xmm0
mov dword [0x46421c], 0
mov dword [0x464220], 0
mov dword [0x464224], 0
call esi
mov dword [0x46417c], 0x79
movsd xmm0, qword [0x453d50]
push 0x464290
mov byte [0x464244], 0
movsd qword [0x464258], xmm0
call esi
mov dword [0x461844], 0
mov dword [0x46424c], 0
mov dword [0x4642b0], 0
movsd xmm0, qword [0x453d50]
movsd qword [0x4642d0], xmm0
xorps xmm0, xmm0
mov byte [0x4642cc], 0
movups xmmword [0x46431c], xmm0
mov dword [0x46432c], 0
mov dword [0x464330], 0
mov dword [0x464334], 0
mov dword [0x464340], 0x4522a8
mov dword [0x464344], 0
mov dword [0x464348], 0
mov dword [0x46434c], 0
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 0x14
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
mov word [0x464350], 0
push eax
movups xmmword [0x464352], xmm0
mov dword [0x464362], 0
mov byte [0x464366], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x402070
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x280]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x280]
test eax, eax
jne 0x402064
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
jmp 0x402070
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x284]
push 0x104
push 0x461cf0
push 0
mov dword [0x461cec], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x27c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x46413c
call esi
push 0x4618ac
call esi
push 0x464154
call esi
lea eax, [ebp - 0x18]
mov byte [0x464139], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.00447a00
movsd xmm1, qword [0x453de0]
divsd xmm1, xmm0
push 1
movsd qword [0x4618c8], xmm1
movsd xmm1, qword [0x453dc8]
divsd xmm1, xmm0
movsd qword [0x461ce0], xmm1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov dword [0x4618d0], 0
call fcn.00418100
lea eax, [ebp - 0xec]
mov dword [0x4618a8], 0x462458
push eax
mov dword [0x463b00], 0x462458
mov dword [0x464170], 0x462458
mov dword [ebp - 0xec], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe4]
cmp ecx, 6
jne 0x402173
cmp eax, 1
jne 0x40215b
mov eax, 0x4536b4
jmp 0x40219e
cmp eax, 2
jne 0x402167
mov eax, 0x4536bc
jmp 0x40219e
cmp eax, 3
jne 0x402183
mov eax, 0x4536b8
jmp 0x40219e
cmp ecx, 0xa
jne 0x402183
test eax, eax
jne 0x402183
mov eax, str.10.0
jmp 0x40219e
push eax
push ecx
push str._d._d
push 0xa
push 0x466234
call fcn.004013f0
add esp, 0x14
mov eax, 0x466234
push eax
push 0xa
push 0x464230
call fcn.0042a8b3
add esp, 0xc
push 0
push 0x4624c8
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x4624d8], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x453db8]
movsd qword [0x4624e0], xmm0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
mov dword [0x462600], 0x4522e8
mov dword [0x462604], 0x2715
mov esi, 0x463c18
mov dword [0x4639a4], 0
mov edi, 0x463d98
mov byte [0x464138], 0
mov byte [0x462534], 0
mov byte [0x462555], 0
mov dword [0x4618a4], 0x462458
mov dword [ebp - 0x284], eax
nop word [eax + eax]
push 0x40
mov dword [edi], eax
lea eax, [esi + 0xc0]
push 0
push eax
call fcn.00423a10
push 0x40
push 0
push esi
call fcn.00423a10
mov eax, dword [ebp - 0x284]
add edi, 0x2c
inc eax
add esp, 0x18
add esi, 0x40
mov dword [ebp - 0x284], eax
cmp edi, 0x463e1c
jl 0x402250
mov edx, dword [0x464340]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022b0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00407e40
push ecx
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x294]
call fcn.00416970
add esp, 4
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x402311
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402307
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40242f
push ecx
push edx
call fcn.00421cfe
add esp, 8
mov esi, dword [ebp - 0x294]
xor ecx, ecx
mov dword [ebp - 0x280], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x290]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x4023e8
xor edi, edi
add esi, edi
lea ecx, [ebp - 0x58]
lea eax, [esi + 0x18]
push eax
call fcn.00407b60
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call fcn.00407b60
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x58]
mov esi, dword [0x464348]
push eax
cmp esi, dword [0x46434c]
je 0x40239c
mov ecx, esi
mov dword [ebp - 0x284], esi
call fcn.00407b60
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x1a
lea ecx, [esi + 0x18]
push eax
mov dword [ebp - 0x14], ecx
call fcn.00407b60
add dword [0x464348], 0x30
jmp 0x4023a7
push esi
mov ecx, 0x464344
call fcn.00407fc0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x17
call fcn.00402490
mov ecx, dword [ebp - 0x290]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x294]
add edi, 0x30
add dword [ebp - 0x280], 2
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x280], eax
jl 0x402342
push 0
push 0x462444
push 0x461840
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [ebp - 0x294]
call fcn.00407c10
mov eax, 0x462458
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042195a
mov esp, ebp
pop ebp
ret
call fcn.00430308
int3