Function at 0xb5d3e1
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 0xc796e1
call fcn.00be12c8
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 0x410], ecx
call dword [0xd8648c]
push eax
call fcn.00be2460
pop ecx
call fcn.004584ec
jmp 0xb5d41e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x5f
mov byte [ebp - 0x14], 0x33
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x6c
and byte [ebp - 0xe], 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [ebp - 0x124], eax
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0xb5d4b8
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x154]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x310], ecx
mov eax, dword [ebp - 0x310]
cmp dword [eax], 0x4550
jne 0xb5d4b8
mov eax, dword [ebp - 0x310]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x130], eax
push 0x200
push 0x401234
push 0xd8091c
call fcn.00be1330
add esp, 0xc
mov dword [ebp - 0x15c], 0x40
jmp 0xb5d4e8
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x4a
jge 0xb5d51f
call fcn.00458809
mov ecx, dword [ebp - 0x15c]
mov dword [ecx*4 + 0xd8091c], eax
mov eax, dword [ebp - 0x15c]
cmp dword [eax*4 + 0xd8091c], 0
jne 0xb5d51d
xor eax, eax
mov dword [esp], eax
add esp, 4
jmp 0xb5d513
jmp 0xb5d4db
call fcn.00be246d
cdq
mov ecx, 0xa
idiv ecx
mov dword [ebp - 0x2fc], edx
mov eax, dword [ebp - 0x2fc]
add eax, 0x40
mov dword [ebp - 0x2fc], eax
push str.WSAStartup
mov eax, dword [ebp - 0x2fc]
push dword [eax*4 + 0xd8091c]
call fcn.00458556
mov dword [ebp - 0x308], eax
mov byte [ebp - 0x140], 0x67
mov byte [ebp - 0x13f], 0x65
mov byte [ebp - 0x13e], 0x74
mov byte [ebp - 0x13d], 0x70
mov byte [ebp - 0x13c], 0x65
mov byte [ebp - 0x13b], 0x65
mov byte [ebp - 0x13a], 0x72
mov byte [ebp - 0x139], 0x6e
mov byte [ebp - 0x138], 0x61
mov byte [ebp - 0x137], 0x6d
mov byte [ebp - 0x136], 0x65
and byte [ebp - 0x135], 0
cmp dword [ebp - 0x308], 0
je 0xb5d5e2
lea eax, [ebp - 0x2f0]
push eax
push 2
call dword [ebp - 0x308]
test eax, eax
jne 0xb5d5e2
movzx eax, word [ebp - 0x2f0]
and eax, 0xff
movzx eax, al
cmp eax, 2
je 0xb5d5fc
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xd80b28], eax
jmp 0xb5d63b
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x2fc]
push dword [eax*4 + 0xd8091c]
call fcn.00458556
mov dword [0xd80b28], eax
cmp dword [0xd80b28], 0
jne 0xb5d63b
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xd80b28], eax
call fcn.00be246d
cdq
mov ecx, 5
idiv ecx
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
add eax, 0x40
mov dword [ebp - 0x148], eax
and dword [ebp - 0x160], 0
jmp 0xb5d673
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 6
jge 0xb5d69e
mov eax, dword [ebp - 0x148]
push dword [eax*4 + 0xd8091c]
call fcn.00458abc
pop ecx
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
jmp 0xb5d666
mov eax, dword [0xd80b28]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x304], eax
push 3
push 0xd767e0
push dword [ebp - 0x14c]
call fcn.00be2090
add esp, 0xc
test eax, eax
je 0xb5d6dd
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
jmp 0xb5d6b5
mov eax, dword [ebp - 0x14c]
add eax, 3
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x304]
mov dword [0xd87fd8], eax
mov dword [ebp - 0x12c], 0x40
and dword [ebp - 0x134], 0
jmp 0xb5d71d
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xa
jge 0xb5d75b
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x12c]
push dword [eax*4 + 0xd8091c]
call fcn.00458556
mov ecx, dword [ebp - 0x134]
mov dword [ecx*4 + 0xd87f88], eax
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
jmp 0xb5d710
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, 0xea60
jb 0xb5d775
xor eax, eax
mov dword [esp], eax
add esp, 4
jmp 0xb5d76b
xor eax, eax
cmp dword [0xd80ebc], 0
setne al
test eax, eax
jne 0xb5d78a
call fcn.00b63704
xor eax, eax
cmp dword [0xd80ebc], 0
setne al
test eax, eax
je 0xb5d7a5
mov ecx, dword [0xd80ebc]
call fcn.00bc6cca
call fcn.004a9178
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5d7f8
and dword [ebp - 0x324], 0
push 0xffffffffffffffff
push str.Initializing...
lea ecx, [ebp - 0x324]
call fcn.0041736e
and dword [ebp - 4], 0
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.00406a50
mov eax, dword [0xd808e8]
mov eax, dword [eax + 0x9c]
neg eax
sbb eax, eax
and eax, 0xfffffff0
add eax, 0x10
mov dword [0xd87fe0], eax
mov ecx, dword [ebp - 0x410]
call fcn.00b5f5a6
mov ecx, dword [ebp - 0x410]
call fcn.00b5f5d5
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5d879
and dword [ebp - 0x328], 0
push 0xffffffffffffffff
push str.ok__r_n
lea ecx, [ebp - 0x328]
call fcn.0041736e
mov dword [ebp - 4], 1
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.00406a50
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5d8ca
and dword [ebp - 0x32c], 0
push 0xffffffffffffffff
push str.Connecting_to_server...
lea ecx, [ebp - 0x32c]
call fcn.0041736e
mov dword [ebp - 4], 2
lea eax, [ebp - 0x32c]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x32c]
call fcn.00406a50
call fcn.00b63615
xor eax, eax
cmp dword [0xd80ebc], 0
setne al
test eax, eax
je 0xb5d913
mov ecx, dword [0xd80ebc]
call fcn.00bc76c6
mov eax, dword [ebp - 0x410]
mov eax, dword [eax + 4]
mov dword [ebp - 0x388], eax
mov eax, dword [0xd80ebc]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x388]
mov dword [eax + 8], ecx
jmp 0xb5d927
call 0xb6365a
call fcn.00b6396e
call fcn.00b636b0
mov ecx, dword [ebp - 0x410]
call fcn.00b5f939
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5d992
and dword [ebp - 0x330], 0
push 0xffffffffffffffff
push str.ok__r_n
lea ecx, [ebp - 0x330]
call fcn.0041736e
mov dword [ebp - 4], 3
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.00406a50
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5d9e3
and dword [ebp - 0x334], 0
push 0xffffffffffffffff
push str.Graphic__Sound...
lea ecx, [ebp - 0x334]
call fcn.0041736e
mov dword [ebp - 4], 4
lea eax, [ebp - 0x334]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.00406a50
mov ecx, dword [ebp - 0x410]
call fcn.00b608b2
mov ecx, dword [ebp - 0x410]
call fcn.00b60cf6
push 5
mov eax, dword [ebp - 0x410]
push dword [eax + 4]
call dword [0xd862a4]
mov eax, dword [ebp - 0x410]
push dword [eax + 4]
call dword [0xd862a0]
mov eax, dword [ebp - 0x410]
push dword [eax + 4]
call dword [0xd86388]
cmp dword [0xd87954], 0
jne 0xb5da3b
push 0x80004003
call fcn.00be0541
mov ecx, dword [0xd87954]
call fcn.00844f34
push 0x64
call dword [0xd8614c]
mov ecx, dword [ebp - 0x410]
call fcn.00b60e0c
push 0x64
call dword [0xd8614c]
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5dab2
and dword [ebp - 0x338], 0
push 0xffffffffffffffff
push str.ok__r_n
lea ecx, [ebp - 0x338]
call fcn.0041736e
mov dword [ebp - 4], 5
lea eax, [ebp - 0x338]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.00406a50
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5db03
and dword [ebp - 0x33c], 0
push 0xffffffffffffffff
push str.Loading_data.
lea ecx, [ebp - 0x33c]
call fcn.0041736e
mov dword [ebp - 4], 6
lea eax, [ebp - 0x33c]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x33c]
call fcn.00406a50
mov ecx, dword [ebp - 0x410]
call fcn.00b61527
call fcn.00b6383b
mov ecx, eax
call fcn.006e73fe
call fcn.00b63279
mov ecx, eax
call fcn.007d59d2
test eax, eax
jne 0xb5db66
mov dword [ebp - 0x344], 0x22000006
lea eax, [ebp - 0x344]
mov dword [ebp - 0x414], eax
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x414]
mov eax, dword [eax]
mov dword [ebp - 0x340], eax
push 0xc98db8
lea eax, [ebp - 0x340]
push eax
call fcn.00be12e7
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5dbb7
and dword [ebp - 0x348], 0
push 0xffffffffffffffff
push 0xd76788
lea ecx, [ebp - 0x348]
call fcn.0041736e
mov dword [ebp - 4], 8
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x348]
call fcn.00406a50
mov ecx, dword [0xd82b90]
call fcn.007db855
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5dc13
and dword [ebp - 0x34c], 0
push 0xffffffffffffffff
push 0xd76788
lea ecx, [ebp - 0x34c]
call fcn.0041736e
mov dword [ebp - 4], 9
lea eax, [ebp - 0x34c]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c]
call fcn.00406a50
mov ecx, dword [0xd82b90]
call fcn.007dccb5
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5dc6f
and dword [ebp - 0x350], 0
push 0xffffffffffffffff
push str.ok__r_n
lea ecx, [ebp - 0x350]
call fcn.0041736e
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.00406a50
xor eax, eax
cmp dword [0xd83da0], 0
setne al
test eax, eax
je 0xb5dcc0
and dword [ebp - 0x354], 0
push 0xffffffffffffffff
push str.Complete_
lea ecx, [ebp - 0x354]
call fcn.0041736e
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x354]
push eax
mov ecx, dword [0xd83da0]
call fcn.00840b0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x354]
call fcn.00406a50
call fcn.00b63335
mov ecx, eax
call fcn.0074165b
test eax, eax
jne 0xb5dd0c
mov dword [ebp - 0x35c], 0x22000006
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x418]
mov eax, dword [eax]
mov dword [ebp - 0x358], eax
push 0xc98db8
lea eax, [ebp - 0x358]
push eax
call fcn.00be12e7
mov ecx, dword [ebp - 0x410]
call fcn.00b5f8bc
push 0
push 0
mov ecx, dword [0xd808e8]
call fcn.004bc0ef
call fcn.00b63568
mov ecx, eax
call fcn.004072b6
call fcn.00b635be
call fcn.00b6391b
xor eax, eax
cmp dword [0xd80ebc], 0
setne al
test eax, eax
je 0xb5dd60
mov eax, dword [ebp - 0x410]
push dword [eax + 4]
mov ecx, dword [0xd80ebc]
call fcn.00bc70c1
jmp 0xb5dd72
and byte [ebp - 0x2f8], 0
mov dword [ebp - 0x144], 0x400000
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x144]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x30c], ecx
mov eax, dword [ebp - 0x30c]
add eax, 4
mov dword [ebp - 0x300], eax
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + 0x80]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0xb5de35
mov eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x158]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp dword [eax + 0xc], 0
je 0xb5de35
mov eax, dword [ebp - 0x314]
mov ecx, dword [ebp - 0x144]
add ecx, dword [eax]
mov dword [ebp - 0x318], ecx
mov eax, dword [ebp - 0x318]
cmp dword [eax], 0
je 0xb5de24
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x318]
add eax, 4
mov dword [ebp - 0x318], eax
jmp 0xb5ddfb
mov eax, dword [ebp - 0x314]
add eax, 0x14
mov dword [ebp - 0x314], eax
jmp 0xb5dddb
cmp dword [ebp - 0x150], 0x14
jbe 0xb5de45
mov byte [ebp - 0x2f8], 1
movzx eax, byte [ebp - 0x2f8]
test eax, eax
je 0xb5de5a
xor eax, eax
mov dword [esp], eax
add esp, 4
jmp 0xb5de50
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [0xd860e4]
lea eax, [ebp - 0x120]
push eax
call fcn.00b6222d
pop ecx
lea eax, [ebp - 0x120]
push eax
call fcn.00b622af
pop ecx
lea eax, [ebp - 0x120]
push eax
call fcn.00b6226e
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x360], esp
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
and dword [eax], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x404]
call fcn.0041736e
mov dword [ebp - 4], 0xd
call fcn.00565936
mov ecx, eax
or dword [ebp - 4], 0xffffffff
call fcn.004ba2de
call fcn.00b63749
mov ecx, dword [ebp - 0x410]
call fcn.00b6275c
push 0x3c
mov ecx, 0xd86a88
call fcn.004030bb
mov dword [ebp - 0x368], eax
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x368], 0
je 0xb5df1d
mov ecx, dword [ebp - 0x368]
call fcn.006de36e
mov dword [ebp - 0x41c], eax
jmp 0xb5df24
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x364], eax
or dword [ebp - 4], 0xffffffff
push 0
push dword [ebp - 0x364]
call fcn.00844f55
pop ecx
pop ecx
mov dword [ebp - 0x2f4], 0xdd04eeee
and dword [ebp - 0x128], 0
jmp 0xb5df63
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x100
jge 0xb5dff4
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x320], 8
jmp 0xb5df98
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jle 0xb5dfdc
mov eax, dword [ebp - 0x31c]
and eax, 1
test eax, eax
je 0xb5dfcc
mov eax, dword [ebp - 0x31c]
shr eax, 1
mov ecx, dword [ebp - 0x2f4]
sub ecx, 0x152d
xor eax, ecx
mov dword [ebp - 0x31c], eax
jmp 0xb5dfda
mov eax, dword [ebp - 0x31c]
shr eax, 1
mov dword [ebp - 0x31c], eax
jmp 0xb5df8b
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x31c]
mov dword [eax*4 + 0xd87b88], ecx
jmp 0xb5df56
jmp 0xb5e009
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret