Function at 0x40d270
Capabilities:
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x4272bc], 0
je 0x40d2ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4272c0]
cmp eax, 0x3e8
jae 0x40d2b8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push dword [0x4272bc]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x40d2b8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push dword [0x4272bc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [0x4272bc], 0
push ebx
call fcn.0040df10
mov ebx, eax
mov dword [ebp - 0x1c], 0
mov eax, 0x5a4d
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0
cmp word [ebx], ax
je 0x40d2f8
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40d316
cmp dword [esi], 0x4550
je 0x40d31e
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x20b
mov ecx, 0x108
cmp word [esi + 0x18], dx
mov eax, 0xf8
movzx edx, word [esi + 6]
cmove eax, ecx
xor ecx, ecx
add eax, esi
push edi
test edx, edx
je 0x40d358
cmp dword [eax + 0x14], 0
je 0x40d350
test dword [eax + 0x24], 0x20000020
jne 0x40d361
inc ecx
add eax, 0x28
cmp ecx, edx
jl 0x40d341
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test edi, edi
je 0x40d358
xor ecx, ecx
lea eax, [edi + 3]
shr eax, 2
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc140.dll_Ordinal_265
push edi
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0x10
cmp edx, dword [esi + 0x34]
je 0x40d453
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x40d453
cmp dword [eax + edx], 0
lea ebx, [eax + edx]
je 0x40d453
lea eax, [ebx + 4]
xor esi, esi
mov dword [ebp - 0xc], eax
lea edi, [ebx + 8]
mov eax, dword [eax]
sub eax, 8
test eax, 0xfffffffe
jbe 0x40d442
nop dword [eax]
movzx ecx, word [edi]
mov eax, ecx
and eax, 0xfff
add eax, dword [ebx]
add eax, edx
mov edx, eax
sub edx, dword [ebp - 8]
js 0x40d42d
cmp edx, dword [ebp - 0x10]
jae 0x40d42d
shr ecx, 0xc
test ecx, ecx
je 0x40d42d
cmp ecx, 3
je 0x40d41c
push 0
push 0x41bce8
push str.Relocation_type_not_handled.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40d42d
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
add eax, dword [ecx + 0x34]
mov ecx, dword [ebp - 0x14]
mov dword [edx + ecx], eax
mov eax, dword [ebp - 0xc]
inc esi
mov edx, dword [ebp - 4]
add edi, 2
mov eax, dword [eax]
sub eax, 8
shr eax, 1
cmp esi, eax
jb 0x40d3e0
mov eax, dword [ebp - 0xc]
add ebx, dword [eax]
cmp dword [ebx], 0
jne 0x40d3c6
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
push ebx
push edi
mov eax, dword [ecx]
call dword [eax + 0x10]
push ebx
mov esi, eax
call sub.mfc140.dll_Ordinal_266
add esp, 4
push 0x4272bc
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [0x4272c0], eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret