Function at 0x4e1920
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x65d037]
xor al, byte [0x65d030]
mov byte [0x65d037], al
mov cl, byte [0x65d037]
and cl, 0xfe
mov byte [0x65d037], cl
mov edx, dword [0x65d024]
mov eax, dword [0x65d020]
lea ecx, [eax + edx*2]
mov dword [0x65d020], ecx
xor edx, edx
mov dl, byte [0x65d037]
mov eax, dword [0x65d028]
and eax, 3
mov dl, byte [0x65d036]
xor dl, byte [0x65d037]
mov byte [0x65d036], dl
mov eax, dword [0x65d028]
shr eax, 1
call 0xd07a27e2
add byte gs:[ebx], al
enter 0xd89, 0x2c
shl byte [ebp], 1
xor edx, edx
mov dl, byte [0x65d037]
mov eax, dword [0x65d02c]
and eax, 7
imul edx, eax
mov ecx, dword [0x65d028]
add ecx, edx
mov dword [0x65d028], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xffff0000
mov dword [ebp - 0x10], edx
mov al, byte [0x65d038]
xor al, byte [0x65d039]
mov byte [0x65d038], al
xor ecx, ecx
mov cl, byte [0x65d033]
sar ecx, 3
or ecx, 1
mov dword [ebp - 0x2c], ecx
fild dword [ebp - 0x2c]
fdivr qword [0x65dbe0]
fst qword [0x65dbd0]
fadd qword [0x65d040]
fstp qword [0x65dbd0]
mov edx, dword [ebp - 0x10]
add edx, 0x1000
mov dword [ebp - 0x10], edx
mov al, byte [0x65d031]
add byte [edx], cl
add eax, 0x65d03d
mov byte [0x65d031], al
xor ecx, ecx
mov cl, byte [0x65d035]
sar ecx, 1
or ecx, 1
mov dword [ebp - 0x30], ecx
fild dword [ebp - 0x30]
fdivr qword [0x65d048]
fst qword [0x65dbe0]
fadd qword [0x65c1a8]
fstp qword [0x65dbe0]
mov dl, byte [0x65d035]
and dl, byte [0x65d036]
mov byte [0x65d035], dl
mov eax, dword [0x65d020]
shr eax, 5
mov ecx, dword [0x65d024]
and ecx, eax
mov dword [0x65d024], ecx
xor edx, edx
mov dl, byte [0x65d036]
mov eax, dword [0x65d020]
and eax, 8
imul edx, eax
mov ecx, dword [0x65d02c]
or ecx, edx
mov dword [0x65d02c], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov cl, byte [0x65d032]
xor cl, byte [0x65d03f]
mov byte [0x65d032], cl
xor edx, edx
mov dl, byte [0x65d030]
sar edx, 2
or edx, 3
mov dword [ebp - 0x34], edx
fild dword [ebp - 0x34]
fdivr qword [0x65dbd8]
fst qword [0x65dbd8]
fadd qword [0x65dbd0]
fstp qword [0x65dbd8]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0044bb40
add esp, 4
test eax, eax
je 0x4e1cb2
mov ecx, dword [0x65d028]
shl ecx, 1
or ecx, dword [0x65d02c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0
fild qword [ebp - 0x3c]
fadd qword [0x65d040]
fstp qword [0x65d040]
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [edx]
cmp eax, dword [ebp - 0x1c]
je 0x4e1bf7
jmp 0x4e1cb2
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0xc]
je 0x4e1c15
jmp 0x4e1cb2
mov edx, dword [0x65d020]
shl edx, 3
or edx, dword [0x65d024]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0
fild qword [ebp - 0x44]
fstp qword [0x65d048]
mov eax, dword [0x65d024]
xor eax, dword [0x65d02c]
shl eax, 1
cmp eax, 0x10d40975
jne 0x4e1c55
mov dword [0x65d028], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x85df00], eax
mov cl, byte [0x65d03d]
and cl, byte [0x65d03a]
mov byte [0x65d03d], cl
mov edx, dword [0x65d024]
shr edx, 2
mov eax, dword [0x65d020]
sub eax, edx
mov dword [0x65d020], eax
xor ecx, ecx
mov cl, byte [0x65d033]
mov edx, dword [0x65d028]
or edx, 7
imul ecx, edx
mov eax, dword [0x65d024]
and eax, ecx
mov dword [0x65d024], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x85def8], ecx
jmp 0x4e1cbf
cmp dword [ebp - 0x10], 0x1000000
ja 0x4e1b11
jmp 0x4e2020
cmp dword [0xa5df18], 0x23f0
jae 0x4e1e07
mov dl, byte [0x65d034]
and dl, byte [0x65d039]
mov byte [0x65d034], dl
mov eax, dword [0x65d02c]
shl eax, 4
mov ecx, dword [0x65d028]
and ecx, eax
mov dword [0x65d028], ecx
xor edx, edx
mov dl, byte [0x65d035]
mov eax, dword [0x65d024]
and eax, 8
imul edx, eax
mov ecx, dword [0x65d02c]
or ecx, edx
mov dword [0x65d02c], ecx
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dl, byte [0x65d033]
xor dl, byte [str.t_n_n]
mov byte [0x65d033], dl
xor eax, eax
mov al, byte [0x65d031]
sar eax, 2
or al, 3
mov dword [ebp - 0x48], eax
fild dword [ebp - 0x48]
fdivr qword [0x65dc40]
fst qword [0x65dc40]
fadd qword [0x65dbe0]
fstp qword [0x65dc40]
mov ecx, dword [0x85df00]
mov esi, dword [0x65dd2c]
xor esi, dword [ecx + 3]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jne 0x4e1d90
jmp dword [eax + 0xa5df18]
mov dword [0x65da8a], 0x706d6f63
mov dword [0x65da8e], 0x69757473
mov dword [0x65da92], 0x6c6c642e
mov dword [ebp - 0x14], 0xa
mov dword [ebp - 8], 8
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x65d020]
shl edx, 1
or edx, dword [0x65d024]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], 0
fild qword [ebp - 0x50]
fadd qword [0x65d048]
fstp qword [0x65d048]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 0x65da78]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x65de3c], eax
jmp 0x4e201b
cmp dword [0xa5df18], 0x23f0
jb 0x4e2015
mov al, byte [0x65d03d]
and al, byte [0x65d03a]
mov byte [0x65d03d], al
mov ecx, dword [0x65d024]
shr ecx, 2
mov edx, dword [0x65d020]
sub edx, ecx
mov dword [0x65d020], edx
xor eax, eax
mov al, byte [0x65d033]
mov ecx, dword [0x65d028]
or ecx, 7
imul eax, ecx
mov edx, dword [0x65d024]
and edx, eax
mov dword [0x65d024], edx
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [0x65d038]
xor al, byte [0x65d039]
mov byte [0x65d038], al
xor ecx, ecx
mov cl, byte [0x65d033]
sar ecx, 3
or ecx, 1
mov dword [ebp - 0x54], ecx
fild dword [ebp - 0x54]
fdivr qword [0x65dbe0]
fst qword [0x65dbd0]
fadd qword [0x65d040]
fstp qword [0x65dbd0]
mov edx, dword [0x85df00]
mov esi, dword [0x65dd2c]
xor esi, dword [edx + 5]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jne 0x4e1eda
jmp dword [eax + 0xa5df18]
mov eax, dword [0x65d020]
shl eax, 1
or eax, dword [0x65d024]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0
fild qword [ebp - 0x5c]
fadd qword [0x65d048]
fstp qword [0x65d048]
mov dword [0x65da88], 0x78707061
mov cl, byte [0x65d035]
and cl, byte [0x65d036]
mov byte [0x65d035], cl
mov edx, dword [0x65d020]
shr edx, 5
mov eax, dword [0x65d024]
and eax, edx
mov dword [0x65d024], eax
xor ecx, ecx
mov cl, byte [0x65d036]
mov edx, dword [0x65d020]
and edx, 8
imul ecx, edx
mov eax, dword [0x65d02c]
or eax, ecx
mov dword [0x65d02c], eax
mov dword [0x65da8c], 0x2e706973
mov ecx, dword [0x65d020]
shl ecx, 3
or ecx, dword [0x65d024]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
fild qword [ebp - 0x64]
fstp qword [0x65d048]
mov edx, dword [0x65d024]
xor edx, dword [0x65d02c]
shl edx, 1
cmp edx, 0x10d40975
jne 0x4e1f9d
mov dword [0x65d028], 0
mov word [0x65da90], 0x6c64
mov eax, dword [0x65d028]
shl eax, 1
or eax, dword [0x65d02c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fadd qword [0x65d040]
fstp qword [0x65d040]
mov cl, byte [0x65da91]
mov byte [0x65da92], cl
push 0x65dc68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x65d02c]
shl edx, 2
or edx, dword [0x65d028]
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], 0
fild qword [ebp - 0x74]
fstp qword [0x65d048]
push 0x65da88
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x65de3c], eax
jmp 0x4e2019
jmp 0x4e202a
jmp 0x4e2017
jmp 0x4e1e0c
invalid
lahf