Function at 0x42074f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push str.shell
push 0x4acf10
call fcn.0040ec17
xor edi, edi
push edi
call fcn.0040d5a0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov cx, word [eax]
add esp, 0xc
cmp cx, 0x2d
mov dword [ebp - 8], edi
mov dl, 0x2a
jne 0x420788
mov dl, cl
movsx esi, dl
movzx ecx, cx
cmp esi, ecx
push 2
pop ebx
jne 0x4207de
movzx ecx, word [eax + 2]
cmp esi, ecx
jne 0x4207de
push ebx
add eax, 4
push eax
push 0x498100
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4207de
add dword [ebp - 4], 8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.00404579
mov eax, dword [ebp - 4]
pop ecx
mov word [eax], di
add dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.0040bc51
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp esi, ecx
jne 0x420833
movzx ecx, word [eax + 2]
cmp esi, ecx
jne 0x420833
add eax, 4
xor esi, esi
mov dword [ebp - 4], eax
inc esi
push esi
lea eax, [ebp - 4]
push eax
push 0x4980fc
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x42082b
add dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
push 0x4972ec
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x42086a
mov esi, ebx
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
jmp 0x42087d
push 5
lea eax, [ebp + 8]
push eax
push str._user
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x42084f
xor esi, esi
inc esi
jmp 0x42087d
push 4
lea eax, [ebp + 8]
push eax
push str._sys
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x42086a
mov esi, ebx
jmp 0x42087d
push str.UCallBackhWnd
call fcn.0040e444
mov esi, eax
neg esi
sbb esi, esi
pop ecx
neg esi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x4208a2
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x2c
lea eax, [ebp - 8]
call fcn.004754d0
mov eax, dword [ebp - 8]
cmp word [eax], di
pop ecx
je 0x4208a2
mov word [eax], di
add eax, ebx
cmp esi, edi
jne 0x4208b2
cmp word [eax], di
je 0x4208b2
push eax
call fcn.00420079
pop ecx
push str.Shell.x
mov edi, str.SOFTWAREPELOGON
push edi
mov ebx, 0x80000002
push ebx
call fcn.004317de
push 0
call fcn.0040e3e1
add esp, 0x10
cmp esi, 1
mov esi, str.UShell
je 0x4208e2
mov esi, dword [0x4acefc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push edi
push ebx
call fcn.00431794
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
add esp, 0x18
call esi
mov dword [ebp - 0x18], eax
and dword [ebp - 0xc], 0
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push str.SysShel.ack
push edi
push ebx
call fcn.0043174a
add esp, 0x18
xor edi, edi
test eax, eax
jne 0x420940
cmp dword [ebp - 0xc], edi
jne 0x420a04
mov dword [ebp - 8], edi
call esi
mov edi, eax
add edi, 5
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x4209ea
cmp byte [0x4ab290], 0
jle 0x4209ea
test ecx, ecx
jbe 0x4209d8
cmp ecx, 0x7d0
jbe 0x420978
mov ecx, 0x3e8
jmp 0x420980
cmp ecx, 0x64
jbe 0x420980
push 0x64
pop ecx
push 0x4bf
push ecx
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x4209d8
cmp dword [ebp - 8], 0
jg 0x4209a6
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x4209e1
push 3
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4209e1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], 0
jle 0x4209d8
dec dword [ebp - 8]
cmp byte [0x4ab290], 0
jg 0x420996
and dword [ebp - 8], 0
jmp 0x42094a
call esi
sub eax, dword [ebp - 0x18]
cmp eax, 0x1770
ja 0x420aa6
mov edi, str.SOFTWAREPELOGON
jmp 0x420909
mov dword [ebp - 8], edi
call esi
mov ebx, eax
add ebx, 0x96
call esi
mov ecx, ebx
sub ecx, eax
cmp ecx, edi
jle 0x420aa6
cmp byte [0x4ab290], 0
jle 0x420aa6
cmp ecx, edi
jbe 0x420a95
cmp ecx, 0x7d0
jbe 0x420a3b
mov ecx, 0x3e8
jmp 0x420a43
cmp ecx, 0x64
jbe 0x420a43
push 0x64
pop ecx
push 0x4bf
push ecx
push edi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x420a95
cmp dword [ebp - 8], edi
jg 0x420a66
call esi
mov ecx, ebx
sub ecx, eax
test ecx, ecx
jle 0x420a9e
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x420a9e
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], edi
jle 0x420a95
dec dword [ebp - 8]
cmp byte [0x4ab290], 0
jg 0x420a57
mov dword [ebp - 8], edi
jmp 0x420a11
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret