Function at 0x409620
Capabilities:
Allocate or change rwx memory
Check for time delay via queryperformancecounter
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
push esi
push edi
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp - 0x8e]
mov edx, dword [ebp - 0x8a]
and ecx, 0xffff
shl ecx, 0x10
and edx, 0xffff
xor ebx, ebx
or ecx, edx
push ebx
mov dword [0x4eb924], ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [0x4eb924]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], 0xfa0
mov dword [ebp - 0xb0], 0x1f40
lea esi, [ebp - 0xb8]
mov dword [ebp - 4], 3
imul edi, edi, 0x5d588b65
inc edi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], ebx
fild qword [ebp - 0xc0]
fmul qword [0x4a1598]
call fcn.00408160
mov ecx, dword [ebp + eax*4 - 0xb8]
mov edx, dword [esi]
lea eax, [ebp + eax*4 - 0xb8]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov dword [esi], ecx
add esi, 4
dec eax
mov dword [ebp - 4], eax
jne 0x409692
mov dword [0x4eb924], edi
mov dword [ebp - 0x5c], 0x70007500
mov dword [ebp - 0x58], 0x65007400
mov dword [ebp - 0x54], 0x53007500
mov dword [ebp - 0x50], 0x6e007200
mov dword [ebp - 0x4c], 0x4100
mov dword [ebp - 0xec], 0x74004f
mov dword [ebp - 0xe8], 0x440075
mov dword [ebp - 0xe4], 0x670062
mov dword [ebp - 0xe0], 0x690074
mov dword [ebp - 0xdc], 0x67
call fcn.00409350
test eax, eax
je 0x409c84
mov byte [0x4d48d7], 0x20
xor ecx, ecx
mov eax, 0x914f64
mov edx, 0x3e8
mov dword [eax - 4], ecx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0xfd4], 0xffffffff
mov dword [eax + 0xfd8], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0xff8], edx
add eax, 0x1028
inc ecx
cmp eax, 0xd08bf4
jl 0x409751
call fcn.004111f0
test eax, eax
je 0x409c84
push 0x2ee0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x7c], esi
call fcn.0043e930
mov ecx, dword [str.jdqmdk21_ckk]
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x4ba514]
mov dword [ebp - 0x30], ecx
mov cx, word [0x4ba51c]
mov word [ebp - 0x24], cx
mov ecx, dword [0x4ba504]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov dword [ebp - 0x3a], ecx
mov dword [ebp - 0x36], ecx
mov dword [0x8ee640], esi
add esi, eax
mov eax, dword [0x4ba518]
mov byte [ebp - 0x32], cl
mov ecx, dword [0x4ba4fc]
mov dword [0xd0abec], esi
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, 5
mov esi, str.EktrgHmrsqtbshnmB_bgd
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x22], edx
mov dword [ebp - 0x1e], edx
mov byte [ebp - 0x1a], dl
mov edx, dword [0x4ba508]
mov dword [ebp - 0x40], edx
mov edx, dword [str.cdbncd_ahm]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x28], eax
mov eax, dword [str.Uhqst_k_kknb]
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0x48], eax
mov ax, word [0x4ba50c]
xor edx, edx
movsb byte es:[edi], byte [esi]
mov word [ebp - 0x3c], ax
mov eax, dword [0x4ba4f8]
mov dword [ebp - 0xcc], edx
mov ecx, 7
mov esi, str.TfuVoiboemfeFydfqujpoGjlter
lea edi, [ebp - 0xac]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xd4], eax
mov word [ebp - 0xc4], dx
mov ecx, 0x400
xor eax, eax
mov edi, 0x8d16fc
mov dword [0x4eb918], 0xd382
mov byte [ebp - 0xc2], dl
rep stosd dword es:[edi], eax
mov cl, byte [ebp + eax - 0x30]
mov dl, byte [ebp + eax - 0x48]
inc cl
mov byte [ebp + eax - 0x30], cl
mov cl, byte [ebp + eax - 0xd8]
inc dl
inc cl
mov byte [ebp + eax - 0x48], dl
mov dl, byte [ebp + eax - 0xac]
mov byte [ebp + eax - 0xd8], cl
mov cl, byte [ebp + eax - 0x78]
dec dl
inc cl
mov byte [ebp + eax - 0xac], dl
mov byte [ebp + eax - 0x78], cl
inc eax
cmp eax, 0x17
jl 0x40989c
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [0xd09e04]
add ecx, eax
lea eax, [ebp - 0x30]
push eax
mov dword [0xd0abf0], ecx
mov dword [ebp - 0x60], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 0xac]
mov esi, eax
mov dword [ebp - 0x20], ecx
push edx
mov word [ebp - 0x1c], cx
push esi
mov dword [ebp - 0xbc], esi
mov byte [ebp - 0x1a], cl
call edi
mov ecx, dword [0x4c28f4]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp esi, ebx
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov word [ebp - 0x98], ax
mov byte [ebp - 0x96], al
mov dword [ebp - 0x80], ecx
je 0x4099e5
lea edx, [ebp - 0x48]
push edx
push esi
call edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x38], eax
push ecx
mov word [ebp - 0x34], ax
push esi
mov byte [ebp - 0x32], al
call edi
xor edx, edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov word [ebp - 0x64], dx
mov byte [ebp - 0x62], dl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [ebp - 4], ebx
je 0x4099e5
push 0x40
push 0x103000
push dword [ebp - 0x80]
push 0
call dword [ebp - 4]
mov dword [0xd0abc4], eax
push 0x40
push 0x3000
push dword [ebp - 0x60]
push 0
call dword [ebp - 4]
mov dword [0xd09e00], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x7c]
add ecx, eax
cmp dword [0xd0abc4], ebx
mov dword [0x8ed8fc], ecx
jne 0x409a1d
mov edx, dword [ebp - 0x80]
push 0x40
push 0x3000
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, ebx
mov dword [0xd0abc4], eax
je 0x409c84
mov ecx, 0x40
xor eax, eax
mov edi, 0xd09bfc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x4081e0
push dword [ebp - 0x60]
call dword [ebp - 0x18]
mov eax, dword [0xd0abc4]
push str.autoexec.scn
push ebx
mov dword [0xecc278], eax
call fcn.00405b00
add esp, 8
test eax, eax
je 0x409c84
xor eax, eax
mov ecx, 0x4d0
mov edi, 0x4f1930
rep stosd dword es:[edi], eax
mov ecx, 0x80
mov edi, 0x4f7640
rep stosd dword es:[edi], eax
mov ecx, 0x490
mov edi, 0x4f2c78
rep stosd dword es:[edi], eax
cmp dword [0x4c23b0], ebx
mov dword [0x914f78], 1
mov dword [0x4eb918], ebx
je 0x409aa0
call fcn.0040a2e0
mov dword [0x4c23b0], eax
call fcn.0040b9a0
call fcn.0040c2d0
xor esi, esi
mov edi, 0x504810
push esi
push edi
call fcn.0043b950
add esp, 8
add edi, 0x1674
inc esi
cmp edi, 0x539d48
jl 0x409ab1
call fcn.0043c1d0
xor eax, eax
mov ecx, 0xb3e0
mov edi, 0x69fd48
rep stosd dword es:[edi], eax
mov ecx, 0x177c
mov edi, 0x8e3b08
rep stosd dword es:[edi], eax
mov ecx, 0x101
mov edi, 0x8ee64c
rep stosd dword es:[edi], eax
mov ecx, 0x101
mov edi, 0x8edd00
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x8c3f28
rep stosd dword es:[edi], eax
mov esi, dword [ebp + eax - 0x5c]
mov ecx, dword [ebp + eax - 0xec]
or esi, ecx
mov dword [ebp + eax - 0x5c], esi
add eax, 4
cmp eax, 0x14
jl 0x409b0d
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0x5c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov eax, 0x8c8e94
mov dword [eax - 4], ebx
mov dword [eax], 0xffffffff
add eax, 8
cmp eax, 0x8c9694
jl 0x409b4d
mov eax, 0x8ccafc
mov dword [eax - 4], ebx
mov dword [eax], ebx
mov dword [eax + 4], 0xffffffff
add eax, 0xc
cmp eax, 0x8cd6fc
jl 0x409b65
xor eax, eax
mov ecx, 0x101
mov edi, 0x8c4328
rep stosd dword es:[edi], eax
mov ecx, 0x101
mov edi, 0x8ee108
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x8efa90
rep stosd dword es:[edi], eax
mov ecx, 0x400
mov edi, 0xd08bf4
rep stosd dword es:[edi], eax
mov ecx, 0x400
mov edi, 0x903ee0
rep stosd dword es:[edi], eax
mov ecx, 0x400
mov edi, 0x8efea0
rep stosd dword es:[edi], eax
mov dword [eax + 0x8e98f8], ebx
mov dword [eax + 0x8cd6f8], ebx
add eax, 0x10
cmp eax, 0x4000
jl 0x409bc5
call fcn.0040a220
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor eax, eax
mov ecx, 0x100
mov edi, 0x8c8448
rep stosd dword es:[edi], eax
push 0x8000
mov ecx, 0x100
mov edi, 0x8c96c8
push ebx
mov dword [0x4eb918], ebx
mov dword [0xd0ac14], ebx
rep stosd dword es:[edi], eax
call esi
mov edx, dword [0x4eb918]
mov dword [edx*4 + 0x8c8448], eax
mov eax, dword [0xd0ac14]
cmp dword [eax*4 + 0x8c8448], ebx
je 0x409c74
xor eax, eax
mov ecx, 0x800
mov edi, 0x8c4730
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x8ed900
rep stosd dword es:[edi], eax
push 0x43000
mov ecx, 0x100
mov edi, 0x8c8848
push ebx
mov dword [0xd0ac1c], ebx
rep stosd dword es:[edi], eax
call esi
cmp eax, ebx
mov ecx, dword [0xd0ac1c]
mov dword [ecx*4 + 0x8ed900], eax
jne 0x409c8d
push str.GlobalAlloc_Error.
push 0xd09bfc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043e0f0
xor eax, eax
mov ecx, 0x404
mov edi, 0x8c7438
rep stosd dword es:[edi], eax
cmp dword [0x4c25f0], ebx
je 0x409d31
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea edx, [ebp - 0xc]
push edx
mov dword [0x4c25f0], ebx
call esi
test eax, eax
je 0x409d31
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x409d31
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fdivp st(1)
fmul qword [0x4a1550]
call fcn.00408160
push 0x1f4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
push ecx
call esi
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fdivp st(1)
fmul qword [0x4a1590]
call fcn.00408160
neg edi
sub edi, eax
cmp edi, 0x1c2
jb 0x409d31
cmp edi, 0x226
ja 0x409d31
mov dword [0x4c25f0], 1
mov eax, dword [0xd0abc0]
add eax, 0x2000
mov dword [0xd0abc8], eax
mov dword [ebp - 4], ebx
xor edx, edx
pushfd
pop eax
xor eax, 0x200000
push eax
popfd
pushfd
pop ebx
cmp eax, ebx
jne 0x409d61
mov eax, 1
cpuid
and edx, 0x6800000
mov eax, 0x30
mov eax, dword fs:[eax]
mov eax, dword [eax + 0x68]
and eax, 0x70
or edx, eax
mov dword [ebp - 4], edx
mov eax, dword [0x4c25e4]
xor esi, esi
cmp eax, esi
je 0x409db3
cmp dword [0x4c25e8], esi
je 0x409da4
mov ecx, dword [ebp - 4]
mov eax, ecx
and eax, 0x2800000
and ecx, 0x2000000
mov dword [0xd0ad84], eax
mov dword [0x4c25e8], ecx
jmp 0x409db8
mov eax, dword [ebp - 4]
and eax, 0x800000
mov dword [0xd0ad84], eax
jmp 0x409db8
mov eax, dword [0xd0ad84]
test eax, 0x2000000
mov dword [0x4c25e4], eax
je 0x409dda
mov dword [0xd08bf0], 0x443b03
mov dword [0x8efe90], 0x443b77
jmp 0x409e0b
test eax, 0x800000
je 0x409df7
mov dword [0xd08bf0], 0x443b03
mov dword [0x8efe90], 0x443b77
jmp 0x409e0b
mov dword [0xd08bf0], 0x443ae8
mov dword [0x8efe90], 0x443b47
call fcn.00414d10
mov edi, eax
xor eax, eax
lea edx, [0x409e1f]
push 0x64
push edx
mov ebx, dword [eax]
push eax
call dword [ebp - 0x18]
call fcn.00414d10
sub eax, edi
cmp eax, 0x14
mov ebx, 1
jae 0x409e3a
mov dword [0x8c3ee4], ebx
xor edi, edi
mov dword [ebp - 0x18], edi
fild dword [ebp - 0x18]
fmul qword [0x4a1588]
fld st(0)
fsin
fmul qword [0x4a1580]
call fcn.00408160
fcos
mov dword [edi*4 + 0x500be8], eax
fmul qword [0x4a1580]
call fcn.00408160
mov dword [edi*4 + 0x50239c], eax
inc edi
cmp edi, 0x100
mov dword [ebp - 0x18], edi
jl 0x409e3f
call fcn.00409550
call fcn.00403910
mov edx, dword [0x8d26fc]
mov ecx, dword [0xd0abc0]
mov eax, dword [0xd09dfc]
push edx
add ecx, 0x4000
push eax
mov dword [0xd0abcc], ecx
mov dword [0xd09e6c], ebx
call fcn.004041e0
add esp, 8
test eax, eax
jne 0x409ed5
push str.DirectInputCreate_Error.
push 0xd09bfc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0xd09e6c], esi
mov dword [0xd09e68], ebx
test byte [ebp - 4], 0x70
je 0x409ef9
cmp dword [0x914f7c], 7
jbe 0x409f2e
mov ecx, dword [0x914f70]
mov dword [ecx], 0x840258
mov edx, dword [0x914f70]
mov dword [edx + 4], esi
xor eax, eax
mov ecx, 0x92
mov edi, 0x4f7640
rep stosd dword es:[edi], eax
mov eax, dword [0xd0abcc]
cmp dword [eax], 0xadaeacaa
je 0x409f1d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0xd09dfc], esi
je 0x409f37
call fcn.004091d0
test eax, eax
jne 0x409f37
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004012e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret