Function at 0x404d37
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 0x1c], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
mov edx, eax
mov eax, dword [ebp - 0x20]
add eax, edx
shl eax, 2
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call eax
sub esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateBitmap]
call eax
sub esp, 0x14
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
call eax
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetBitmapBits]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x11], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edx, dword [ebp - 0x1c]
sub eax, edx
cmp eax, 0xea60
seta al
test al, al
je 0x404ee2
call sym._rand
mov ecx, eax
mov edx, 0x80808081
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 7
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov edx, eax
shl edx, 8
sub edx, eax
mov eax, ecx
sub eax, edx
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jge 0x404fa8
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x24]
mov eax, edx
test eax, eax
jne 0x404f34
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x404f34
mov eax, 1
jmp 0x404f39
mov eax, 0
test al, al
je 0x404f6c
call sym._rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, edx
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
add edx, eax
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
mov edx, dword [ebp - 0x18]
shl edx, 2
mov ecx, edx
mov edx, dword [ebp - 0x10]
add ecx, edx
mov edx, dword [ebp - 0x28]
add edx, ecx
xor al, byte [ebp - 0x11]
mov byte [edx], al
add dword [ebp - 0x18], 1
jmp 0x404ee9
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SetBitmapBits]
call eax
sub esp, 0xc
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0xc]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0xc], edx
jmp 0x404daf