Function at 0x401000
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa
Terminate process

Disassembly:
push 0x402f3c
xor eax, eax
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.00402f60
mov dword [section.DATA], eax
push 0x403030
push 0
call fcn.00402f78
test eax, eax
jne 0x40110f
xor eax, eax
push eax
push 0x401043
push eax
push 0x65
push eax
call fcn.00402f8a
jmp 0x40110f
push 0
push dword [0x40300c]
call fcn.00402f7e
push 0
call fcn.00402f5a
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebp
mov edx, 0x4036f3
mov ecx, 0x40309b
sub edx, ecx
push edx
push ecx
call fcn.00402f66
call fcn.00402f6c
xor esi, esi
push eax
and eax, 0xff
movzx ebx, byte [eax + 0x403d9c]
add esi, ebx
xor bl, 0x44
and ebx, 0x1a
add ebx, 8
not ebx
and ebx, 0xff
add esi, ebx
movzx ebx, byte [ebx + 0x403c8a]
and ebx, 0xff
xchg ebx, eax
movzx eax, byte [eax + 0x403b78]
add esi, eax
pop eax
shl eax, 2
add esi, eax
push eax
and eax, 0xff
movzx eax, byte [eax + 0x403b78]
add esi, eax
and eax, 0xb
inc eax
not eax
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
add esi, eax
pop eax
shl eax, 3
and eax, 0xff
movzx eax, byte [eax + 0x403c8a]
xor al, 0x5b
add esi, eax
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
add esi, eax
imul esi, eax
call fcn.00402f6c
push eax
xor ebx, ebx
and eax, 0xff
movzx ebx, byte [eax + 0x403b78]
add esi, ebx
xor bl, 0x4c
and ebx, 0x1a
add ebx, 8
imul ebx, eax
not ebx
and ebx, 0xff
movzx ebx, byte [ebx + 0x403d9c]
and ebx, 0xff
add esi, ebx
pop eax
shl esi, 1
push eax
and eax, 0xff
movzx eax, byte [eax + 0x403b78]
and eax, 0xb
add eax, 0x18
add esi, eax
xor eax, 0x4c307264
not eax
and eax, 0xff
movzx eax, byte [eax + 0x403c8a]
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
add esi, eax
pop eax
shl esi, 2
and eax, 0xff
movzx eax, byte [eax + 0x403c8a]
xor al, 0x5b
add esi, eax
imul eax, eax, 0x30
and eax, 0xff
movzx eax, byte [eax + 0x403b78]
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
add esi, eax
shl esi, 4
call fcn.00402f6c
push eax
and eax, 0xff
movzx eax, byte [eax + 0x403c8a]
imul eax, eax, 0x10
xor eax, 0x52
and eax, 0xff
movzx eax, byte [eax + 0x403c8a]
and eax, 0xff
add esi, eax
movzx eax, byte [eax + 0x403d9c]
pop eax
shl eax, 1
add esi, eax
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
xor ebx, ebx
push eax
and eax, 0xffff
or ebx, eax
pop eax
and eax, 0xffff0000
ror eax, 0x10
xor ax, bx
imul eax, eax
add esi, eax
and eax, 0xff
movzx eax, byte [eax + 0x403d9c]
call fcn.00402f6c
xor ebx, ebx
and eax, 0xff
movzx ebx, byte [eax + 0x403b78]
xor ebx, 0x4441524b
and ebx, 0x1a
add ebx, 8
imul ebx, eax
not ebx
add esi, ebx
imul esi, esi
and ebx, 0xff
movzx ebx, byte [ebx + 0x403d9c]
and ebx, 0xff
add esi, ebx
and esi, 0xffff
call fcn.004015e2
test eax, eax
je 0x40112a
mov dword [0x403573], eax
push 4
push 0x403573
push 0x403553
call fcn.0040162a
add esp, 0xc
mov byte [0x403554], 2
mov byte [0x403557], 0xff
mov byte [0x40355c], 0xff
and byte [0x40355e], 0xf8
and byte [0x40355f], 0xf
or byte [0x40355f], 0x40
mov byte [0x403561], 2
xor eax, eax
xor ebp, ebp
movzx ebx, byte [0x40355b]
or eax, ebx
shl eax, 8
movzx ebx, byte [0x403559]
or eax, ebx
shl eax, 8
movzx ebx, byte [0x403560]
or eax, ebx
shl eax, 8
movzx ebx, byte [0x403553]
or eax, ebx
push 0x1eb
pop ecx
push eax
xor edx, edx
idiv ecx
pop eax
sub eax, edx
xor eax, 0x3a00
push eax
pop edx
and edx, 0xff00
shl edx, 8
or ebp, edx
push eax
push eax
pop ecx
pop ebx
and ebx, 0xff0000
and ecx, 0xff00
shr ebx, 0x10
shr ecx, 8
xor ebx, ecx
push ebx
pop esi
shl ebx, 8
or ebp, ebx
push eax
pop ebx
and ebx, 0xff000000
or ebp, ebx
push eax
pop ebx
and ebx, 0xff
xor esi, ebx
or ebp, esi
push ebp
pop eax
cmp eax, 0xffffffff
je 0x40112a
mov byte [0x403553], al
shr eax, 8
mov byte [0x403560], al
shr eax, 8
mov byte [0x403559], al
shr eax, 8
mov byte [0x40355b], al
mov byte [0x403556], 0
mov byte [0x403558], 0
mov byte [0x40355a], 0
mov byte [0x40355d], 0
mov edx, 0x10
mov ecx, 0x403553
xor eax, eax
lea esi, [ecx + edx]
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
mov edx, 8
shl eax, 1
test ah, ah
jns 0x401466
xor eax, 0x1021
dec edx
jne 0x40145b
cmp ecx, esi
jne 0x40144f
mov byte [0x403556], al
shr eax, 8
mov byte [0x40355a], al
shr eax, 8
mov byte [0x403558], al
shr eax, 8
mov byte [0x40355d], al
mov esi, 0x403553
mov edi, 0x403693
push 0x10
pop ecx
rep movsb byte es:[edi], byte [esi]
mov esi, 0x403693
xor ebp, ebp
xor edx, edx
xor eax, eax
lodsb al, byte [esi]
lea ebx, [ebp + 0x403123]
mov byte [ebx + edx], al
add ebp, 8
cmp ebp, 0x20
jne 0x4014a4
xor ebp, ebp
inc edx
cmp edx, 4
jne 0x4014a4
movzx ebx, byte [0x403559]
or ebx, 0x11
push ebx
push 0x403096
push 0x4036b3
call fcn.00402fae
add esp, 0xc
call fcn.00402186
call fcn.00402e93
xor eax, eax
xor ebp, ebp
xor edx, edx
xor ecx, ecx
lea esi, [ebp + 0x403123]
add esi, edx
lodsb al, byte [esi]
mov byte [ecx + 0x403693], al
inc ecx
add ebp, 8
cmp ebp, 0x20
jne 0x4014ed
xor ebp, ebp
inc edx
cmp edx, 4
jne 0x4014ed
mov esi, 0x403693
xor ebp, ebp
lodsd eax, dword [esi]
xchg al, ah
ror eax, 0x10
xchg al, ah
lea edi, [ebp + 0x403573]
push eax
push 0x403091
push edi
call fcn.00402fae
add esp, 0xc
add ebp, 8
cmp ebp, 0x20
jne 0x401514
mov esi, 0x403573
mov edi, 0x4036c4
xor edx, edx
push 4
pop ecx
rep movsb byte es:[edi], byte [esi]
mov al, 0x2d
stosb byte es:[edi], al
push 5
pop ecx
rep movsb byte es:[edi], byte [esi]
mov al, 0x2d
stosb byte es:[edi], al
inc edx
cmp edx, 6
jne 0x40154d
dec edi
xor al, al
stosb byte es:[edi], al
mov byte [0x4036c3], 0x33
mov ax, word [0x4036b3]
mov word [0x4036ea], ax
push 0x4036c3
push 0
push 0xc
push dword [0x403004]
call fcn.00402fa8
pop ebp
pop edi
pop esi
pop ebx
mov ebp, esp
pop ebp
xor eax, eax
ret