Function at 0x401220
Capabilities:
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Delete file
Print debug messages

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407972
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x200
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], 0
cmp ecx, 0x17
ja case.default.0x401274
jmp dword [ecx*4 + 0x401848]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne al
jmp 0x401317
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je case.default.0x401274
cmp dword [ebp - 0x12c], 0
setne al
jmp 0x401317
mov dword [ebp - 0x12c], 0
xor eax, eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
setne al
jmp 0x401317
push str.Ntdll.dll
mov dword [ebp - 0x12c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je case.default.0x401274
push str.NtQueryInformationProcess
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x401335
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406836
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
push 4
lea eax, [ebp - 0x12c]
push eax
push 0x1e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js case.default.0x401274
cmp dword [ebp - 0x12c], 0
je case.default.0x401274
mov al, 1
jmp 0x401317
call fcn.00401f30
jmp 0x401317
call fcn.00402490
jmp 0x401317
call fcn.00402ab0
jmp 0x401317
mov esi, dword [sym.imp.KERNEL32.dll_HeapWalk]
xorps xmm0, xmm0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
movups xmmword [ebp - 0x20c], xmm0
mov dword [ebp - 0x1f4], 0
movq qword [ebp - 0x1fc], xmm0
lea eax, [ebp - 0x20c]
push eax
call edi
push eax
call esi
test eax, eax
je case.default.0x401274
cmp word [ebp - 0x202], 4
jne 0x4013a2
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x208]
cmp dword [ecx + eax], 0xabababab
sete al
jmp 0x401317
push 4
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x128], esi
test esi, esi
je case.default.0x401274
push 8
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32QueryWorkingSetEx]
test eax, eax
je 0x401429
test byte [ebp - 0x124], 1
mov byte [ebp - 0x20d], 1
jne 0x401430
mov byte [ebp - 0x20d], 0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, byte [ebp - 0x20d]
jmp 0x401317
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne al
jmp 0x401317
call fcn.00402ee0
jmp 0x401317
call fcn.00402f70
jmp 0x401317
push 0xaa289
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str._s_s_s_s_s_s_s_s_s_s
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xaa289
setne al
jmp 0x401317
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4016c4
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
cmp ecx, 0xffffffff
sete al
je 0x401317
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x401274
push 0xb0
lea eax, [ebp - 0x1f0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.dummyfile
lea ecx, [ebp - 0x1f0]
call fcn.004050c0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1a0], 0
je 0x4016b9
lea ecx, [ebp - 0x1ec]
call fcn.00405780
test eax, eax
jne 0x40154e
push eax
mov eax, dword [ebp - 0x1f0]
lea ecx, [ebp - 0x1f0]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 0xb8
lea eax, [ebp - 0xd8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xd8], 0x40a228
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x12c], 1
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xd8], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xdc], eax
lea ecx, [ebp - 0xc8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x8b], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov eax, dword [0x40e6a4]
mov ecx, dword [0x40e6a8]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x90], 0
push ecx
push 1
push str.dummyfile
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
call fcn.00405810
test eax, eax
jne 0x401652
push eax
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x7c], 0
je 0x4016ae
lea ecx, [ebp - 0xc8]
call fcn.00405780
test eax, eax
jne 0x401685
push eax
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push str.dummyfile
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea ecx, [ebp - 0xd8]
call fcn.00403a10
lea ecx, [ebp - 0x1f0]
call fcn.00403950
jmp case.default.0x401274
lea ecx, [ebp - 0xd8]
call fcn.00403a10
lea ecx, [ebp - 0x1f0]
call fcn.00403950
mov al, 1
jmp 0x401317
call fcn.00403010
jmp 0x401317
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x140]
push eax
call esi
xor eax, eax
push eax
push ecx
pop eax
pop ecx
sub ecx, eax
shl ecx, 4
lea eax, [ebp - 0x128]
push eax
call esi
mov ecx, dword [ebp - 0x128]
sub ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x124]
sbb edx, dword [ebp - 0x13c]
call fcn.004078d0
mulsd xmm0, qword [0x40a248]
mov edx, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x130]
movsd qword [ebp - 0x128], xmm0
call fcn.004078d0
movsd xmm1, qword [ebp - 0x128]
divsd xmm1, xmm0
comisd xmm1, xmmword [0x40a240]
seta al
jmp 0x401317
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x138]
push eax
call esi
xor eax, eax
push eax
push ecx
pop eax
pop ecx
sub ecx, eax
shl ecx, 4
lea eax, [ebp - 0x200]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
call esi
test eax, eax
je case.default.0x401274
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x200]
push eax
call esi
test eax, eax
je case.default.0x401274
mov ecx, dword [ebp - 0x128]
sub ecx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x124]
sbb eax, dword [ebp - 0x13c]
jne 0x4016c4
cmp ecx, 0xc350
ja 0x4016c4
jmp case.default.0x401274
rdtsc
mov dword [ebp - 0x124], eax
rdtsc
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x124]
cmp eax, 0xff
setae al
jmp 0x401317
test byte [0x7ffe02d4], 3
setne al
jmp 0x401317
call fcn.004030a0
jmp 0x401317
call fcn.00403120
jmp 0x401317
call fcn.004031a0
jmp 0x401317
call fcn.004034d0
jmp 0x401317