Function at 0x406c14
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, 0x406ba4
call fcn.00402e48
xor eax, eax
push ebp
push 0x407475
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004066bc
call fcn.00406940
call sub.kernel32.dll_GetTickCount
mov dword [0x409d38], eax
push 0x409be8
mov ecx, 0x409ba8
mov eax, 0x407484
mov edx, 0xa
call fcn.00405914
test al, al
je 0x407444
call fcn.00406088
mov byte [0x409c1c], 1
cmp byte [0x409bb8], 0
je 0x406c9c
mov eax, 0x40748c
mov dl, 1
call fcn.004043b0
cmp byte [0x409bbb], 0
je 0x406d3d
mov eax, dword [0x409be8]
call fcn.00404084
mov ebx, eax
mov eax, dword [0x4080ac]
mov dword [eax + 8], ebx
mov eax, dword [0x4080ac]
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edx, dword [0x4080ac]
mov dword [edx], eax
mov eax, dword [0x4080ac]
mov eax, dword [eax + 8]
call fcn.004041d8
mov ebx, eax
mov eax, dword [0x4080ac]
mov dword [eax + 0xc], ebx
mov eax, dword [0x4080ac]
push ebx
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov edx, dword [0x4080ac]
mov dword [edx + 4], eax
mov eax, dword [0x4080ac]
cmp dword [eax + 8], 0
jne 0x406d9b
cmp byte [0x409bba], 0
jne 0x407444
push 0x10
push 0x4074a0
push 0x4074ac
push 0
call sub.user32.dll_MessageBoxA
jmp 0x407444
mov eax, dword [0x4080ac]
push eax
mov eax, dword [0x4080b4]
push eax
push 0
push 0
mov eax, dword [0x409bb4]
push eax
push 0
push 0
push 0
mov eax, dword [0x409d34]
call fcn.004020b8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
neg eax
cmp al, 1
jne 0x406d9b
cmp byte [0x409bba], 0
jne 0x407444
push 0x10
push 0x4074a0
push 0x4074d0
push 0
call sub.user32.dll_MessageBoxA
jmp 0x407444
cmp byte [0x409bb9], 0
je 0x406e41
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x406e2f
cmp dword [0x409bb4], 4
jne 0x406dcf
mov eax, dword [0x4080ac]
mov eax, dword [eax + 4]
mov edx, dword [0x409bbc]
call fcn.00405fa8
jmp 0x406dda
mov eax, dword [0x409bbc]
push eax
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [0x409bc0]
cdq
cmp edx, dword [esp + 4]
jne 0x406e06
cmp eax, dword [esp]
pop edx
pop eax
ja 0x406e2f
jmp 0x406e0a
pop edx
pop eax
jg 0x406e2f
cmp byte [0x409bba], 0
jne 0x407444
push 0x10
push 0x4074a0
push 0x407500
push 0
call sub.user32.dll_MessageBoxA
jmp 0x407444
mov eax, dword [0x409d34]
call fcn.00404014
cmp al, 1
jne 0x406db1
cmp dword [0x409bec], 0
je 0x406eb2
mov eax, dword [0x4080ac]
mov eax, dword [eax + 8]
mov edx, dword [0x409bec]
call fcn.004063c8
test al, al
jne 0x406e79
push 0x10
push 0x4074a0
push 0x407518
push 0
call sub.user32.dll_MessageBoxA
jmp 0x407444
mov ecx, 0x409c24
mov eax, dword [0x4080ac]
mov eax, dword [eax + 8]
mov edx, dword [0x409bec]
call fcn.00406514
test al, al
je 0x406fa8
mov eax, dword [0x409c24]
mov dword [0x409d28], eax
mov eax, dword [0x409c28]
mov dword [0x409d2c], eax
jmp 0x406fa8
mov eax, dword [0x409d34]
call fcn.00403f18
test al, al
je 0x406edd
lea eax, [ebp - 0x18]
mov edx, dword [0x409d34]
call fcn.00402338
mov eax, dword [ebp - 0x18]
mov edx, 0x409c30
call fcn.0040548c
jmp 0x406ef8
lea eax, [ebp - 0x1c]
mov edx, dword [0x409be8]
call fcn.00402338
mov eax, dword [ebp - 0x1c]
mov edx, 0x409c30
call fcn.0040548c
mov eax, dword [0x409c64]
mov dword [0x409d28], eax
mov eax, dword [0x409c80]
mov dword [0x409d2c], eax
cmp byte [0x409bbb], 0
je 0x406f5b
push 0
push 0x18
push 0x409e28
push 0
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
push 0x409e0c
push 4
push 0x409e08
mov eax, dword [0x409e2c]
add eax, 8
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x409e08]
mov dword [0x409d28], eax
jmp 0x406fa8
mov dword [0x409d3c], 0x10007
push 0x409d3c
mov eax, dword [0x4080ac]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x406fa8
push 0x409e0c
push 4
push 0x409e08
mov eax, dword [0x409de0]
add eax, 8
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x409e08]
mov dword [0x409d28], eax
cmp dword [0x409bd4], 0
je 0x4072e9
mov eax, 0x409c20
mov edx, dword [0x409d2c]
call fcn.00402194
mov eax, 0x409c20
call fcn.00402104
mov edx, dword [0x409d2c]
call fcn.00403090
push 0x409ba0
mov eax, dword [0x409d2c]
push eax
mov eax, 0x409c20
call fcn.00402104
push eax
mov eax, dword [0x409d28]
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReadProcessMemory
xor eax, eax
mov dword [0x409e20], eax
mov eax, dword [0x409bd4]
dec eax
test eax, eax
jl 0x4072aa
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [0x409c08]
mov eax, dword [eax + edi*4]
sub eax, 1
jb 0x40702f
je 0x407038
jmp 0x407041
mov byte [0x409e18], 0
jmp 0x407048
mov byte [0x409e18], 1
jmp 0x407048
mov byte [0x409e18], 0
xor eax, eax
mov dword [0x409e1c], eax
xor ebx, ebx
mov byte [0x409e24], 1
mov eax, dword [0x409c10]
mov edx, dword [eax + edi*4]
mov eax, 0x407554
call fcn.0040214c
test eax, eax
jle 0x4070c4
lea edx, [ebp - 0x24]
mov eax, dword [0x409c10]
mov eax, dword [eax + edi*4]
call fcn.00405320
lea edx, [ebp - 0x24]
mov eax, 0x409e10
mov ecx, dword [0x4052f8]
call fcn.00402590
mov eax, dword [0x409e10]
call fcn.00402a48
push eax
mov eax, dword [0x409d2c]
push eax
push 1
push ebx
mov eax, 0x409c20
call fcn.00402104
mov ecx, dword [0x409e14]
mov edx, dword [0x409e10]
call fcn.00405228
mov ebx, eax
jmp 0x4070db
mov eax, dword [0x409c10]
mov eax, dword [eax + edi*4]
mov ecx, ebx
mov edx, dword [0x409c20]
call fcn.00403ba4
mov ebx, eax
cmp ebx, 0xffffffff
jle 0x4072a0
mov eax, dword [0x409c08]
mov ecx, dword [eax + edi*4]
cmp ecx, 1
jle 0x407123
inc dword [0x409e1c]
mov eax, ecx
cdq
push edx
push eax
mov eax, dword [0x409e1c]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x407112
cmp eax, dword [esp]
pop edx
pop eax
jae 0x40711c
jmp 0x407116
pop edx
pop eax
jge 0x40711c
inc ebx
jmp 0x407058
mov byte [0x409e18], 1
mov esi, 1
jmp 0x4071fe
mov eax, dword [0x409c14]
mov eax, dword [eax + edi*4]
cmp byte [eax + esi - 1], 0x3f
je 0x4071fb
mov edx, 0x407558
lea eax, [ebp - 0x2c]
call fcn.004018a8
lea eax, [ebp - 0x30]
mov edx, dword [0x409c14]
mov edx, dword [edx + edi*4]
mov dl, byte [edx + esi - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00401878
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
call fcn.004018a8
lea eax, [ebp - 0x30]
mov edx, dword [0x409c14]
mov edx, dword [edx + edi*4]
mov dl, byte [edx + esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x34]
mov cl, 3
call fcn.00401878
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x28]
call fcn.00401e9c
mov eax, dword [ebp - 0x28]
call fcn.00403c00
mov byte [0x409d30], al
push 0x409ba0
push 1
push 0x409d30
mov eax, dword [0x409d28]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, esi
sar eax, 1
jns 0x4071e2
adc eax, 0
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteProcessMemory
add esi, 2
mov eax, esi
dec eax
cdq
push edx
push eax
mov eax, dword [0x409c0c]
mov eax, dword [eax + edi*4]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x407221
cmp eax, dword [esp]
pop edx
pop eax
ja 0x40712d
jmp 0x407229
pop edx
pop eax
jg 0x40712d
inc ebx
cmp byte [0x409e24], 0
je 0x40724b
mov eax, dword [0x409c08]
cmp dword [eax + edi*4], 0
jne 0x40724b
inc dword [0x409e20]
mov byte [0x409e24], 0
cmp byte [0x409e24], 0
je 0x407279
mov eax, dword [0x409c08]
mov eax, dword [eax + edi*4]
cdq
push edx
push eax
mov eax, dword [0x409e1c]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x40726f
cmp eax, dword [esp]
pop edx
pop eax
jne 0x407279
inc dword [0x409e20]
cmp byte [0x409e24], 0
je 0x407293
mov eax, dword [0x409c08]
cmp dword [eax + edi*4], 1
jne 0x407293
inc dword [0x409e20]
cmp byte [0x409e18], 0
je 0x407058
inc edi
dec dword [ebp - 0x14]
jne 0x40701e
mov eax, dword [0x409e20]
cdq
push edx
push eax
mov eax, dword [0x409bd4]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4072c2
cmp eax, dword [esp]
pop edx
pop eax
je 0x4072e9
mov byte [0x409c1c], 0
cmp byte [0x409bba], 0
jne 0x4072e9
push 0x40
push 0x4074a0
push 0x40755c
push 0
call sub.user32.dll_MessageBoxA
cmp dword [0x409ba8], 0
je 0x4073ef
mov al, byte [0x409be4]
push eax
mov ebx, dword [0x409bf0]
mov eax, ebx
call fcn.00402a50
mov ecx, eax
mov edx, ebx
mov eax, dword [0x409d34]
call fcn.00406a80
mov eax, dword [0x409ba8]
push eax
mov eax, 0x409ba4
mov ecx, 1
mov edx, dword [0x4051dc]
call fcn.00402c04
add esp, 4
mov eax, dword [0x409ba8]
dec eax
test eax, eax
jl 0x4073ef
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
push 0x409ba0
push 1
mov eax, dword [0x409ba4]
add eax, edi
push eax
mov eax, dword [0x409d28]
xor edx, edx
mov ecx, dword [0x409bf0]
add eax, dword [ecx + edi*8]
adc edx, dword [ecx + edi*8 + 4]
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x409ba4]
mov al, byte [eax + edi]
mov edx, dword [0x409bf4]
cmp al, byte [edx + edi]
jne 0x4073c0
push 0x409ba0
push 1
mov eax, dword [0x409bf8]
add eax, edi
push eax
mov eax, dword [0x409d28]
xor edx, edx
mov ecx, dword [0x409bf0]
add eax, dword [ecx + edi*8]
adc edx, dword [ecx + edi*8 + 4]
push eax
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteProcessMemory
jmp 0x4073e5
mov byte [0x409c1c], 0
cmp byte [0x409bba], 0
jne 0x4073ef
push 0x40
push 0x4074a0
push 0x40755c
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4073ef
inc edi
dec dword [ebp - 0x14]
jne 0x407349
cmp byte [0x409c1c], 0
je 0x407411
cmp dword [0x409bb4], 4
jne 0x407429
mov eax, dword [0x4080ac]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_ResumeThread
jmp 0x407429
cmp byte [0x409bbb], 0
jne 0x407429
push 0
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [0x4080ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4080ac]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40747c
lea eax, [ebp - 0x28]
call fcn.00401d28
lea eax, [ebp - 0x24]
mov edx, dword [0x4052f8]
call fcn.0040246c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00402240
ret