Function at 0x4026a3
Capabilities:
Check for time delay via gettickcount
Create process on windows
Encode data using xor
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd0
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 0xcc], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0040125d
call fcn.0040147b
call fcn.00401bf5
call fcn.00401e05
call fcn.00401fce
push 0x40
xor esi, esi
lea eax, [esp + 0x78]
push esi
push eax
call fcn.00405980
add esp, 0xc
mov dword [esp + 0x70], 0x44
mov dword [esp + 0x9c], 1
call fcn.00401fce
xor eax, eax
mov word [esp + 0xa0], ax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x74]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push esi
push ecx
call fcn.00402623
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call fcn.004013ed
test al, al
jne 0x4029e8
call fcn.00402a31
and dword [esp + 0x70], 0
mov esi, eax
xorps xmm0, xmm0
mov dword [esp + 0x74], 0x4021f8
lea eax, [esp + 0x70]
movlpd qword [esp + 0x78], xmm0
push eax
movlpd qword [esp + 0x88], xmm0
movlpd qword [esp + 0x90], xmm0
mov dword [esp + 0x84], edi
mov dword [esp + 0x98], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
xor eax, eax
push eax
push edi
push eax
push eax
push 0x3e8
push 0x578
mov eax, 0x80000000
push eax
push eax
push eax
call fcn.00402aa3
push eax
push esi
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x58]
sub esi, dword [esp + 0x50]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x68]
sub ecx, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
sub esi, ecx
sub edi, dword [esp + 0x5c]
mov eax, esi
mov esi, dword [esp + 0x10]
cdq
push 0x1d
sub eax, edx
push ecx
sar eax, 1
push edi
push eax
mov eax, dword [esp + 0x1c]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0xb8]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x444920], 0
mov dword [esp + 0x14], eax
jl 0x4029a0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], eax
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402893
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.0040125d
call fcn.0040147b
call fcn.00401bf5
call fcn.00401e05
call fcn.00401fce
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
sub esi, dword [esp + 0x3c]
sub edi, dword [esp + 0x40]
call fcn.00409a40
cdq
idiv esi
mov esi, edx
call fcn.00409a40
cdq
idiv edi
push edx
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ecx, edi
sub ecx, dword [esp + 0x14]
cmp ecx, 0x3e8
jb 0x402989
mov ecx, dword [0x444920]
mov esi, dword [esp + 0x10]
dec ecx
mov dword [0x444920], ecx
cmp ecx, 0xffffffff
jne 0x40297a
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
movups xmm0, xmmword [0x441cc0]
xor edx, edx
mov word [esp + 0x2c], 0x4520
mov ecx, edx
movups xmmword [esp + 0x1c], xmm0
mov al, byte [esp + ecx + 0x1c]
xor al, 0x45
mov byte [ecx + 0x445ee8], al
inc ecx
cmp ecx, 0x12
jb 0x402938
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x34]
push eax
push edx
push 0x20006
push edx
push edx
push edx
push 0x445ee8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call fcn.004018c5
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edx
push 1
push 0
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [0x444920], 0
jge 0x40285e
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0xc]
jmp 0x4029a8
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
call fcn.0040125d
call fcn.0040147b
call fcn.00401bf5
call fcn.00401e05
call fcn.00401fce
call fcn.004030e0
push 0
push 0x989680
push edx
push eax
call fcn.00433070
sub eax, edi
sbb edx, esi
jne 0x4029e1
cmp eax, 0x258
jb 0x4029a8
call fcn.0040121a
jmp 0x4029a8
call fcn.00401a0d
mov esi, eax
mov edi, edx
call fcn.0040125d
call fcn.0040147b
call fcn.00401bf5
call fcn.00401e05
call fcn.00401fce
call fcn.004030e0
push 0
push 0x989680
push edx
push eax
call fcn.00433070
sub eax, esi
sbb edx, edi
jne 0x402a2a
cmp eax, 0x258
jb 0x4029f1
call fcn.0040121a
jmp 0x4029f1