Function at 0x10005f80
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x101c1d41], 0
push ebx
push esi
push edi
je 0x10006156
cmp dword [0x101c305c], 0
je 0x10005ff8
mov ecx, dword [0x101c30d4]
lea eax, [ecx - 0x190]
cmp eax, 0x640
ja 0x10005ff8
mov edx, dword [0x101c30b4]
lea eax, [edx - 0x190]
cmp eax, 0x640
ja 0x10005ff8
cmp ecx, dword [0x101c30ec]
jne 0x10005fd8
cmp edx, dword [0x101c3094]
je 0x10005ff8
cmp dword [0x101c3108], 0
push edx
mov dword [0x101c30ec], ecx
push ecx
setne cl
mov dword [0x101c3094], edx
call fcn.10005d10
add esp, 8
cmp byte [0x101c1d42], 0
je 0x100061fd
cmp byte [0x101c1e28], 0
jne 0x100060fe
cmp byte [0x101c1e29], 0
jne 0x10006030
push 0
push 0
xor cl, cl
mov byte [0x101c1e29], 1
call fcn.10005d10
add esp, 8
cmp dword [0x101c1dbc], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
jne 0x10006046
call esi
mov dword [0x101c1dbc], eax
call esi
mov ecx, dword [0x101c1dbc]
add ecx, 0x3e8
test edx, edx
jb 0x10006156
ja 0x10006066
cmp eax, ecx
jbe 0x10006156
mov ch, 0x45
mov byte [esp + 0x16], 0
mov bl, 0x35
mov byte [esp + 0x10], ch
mov ah, bl
mov byte [esp + 0x16], 0
mov al, 0x15
xor ah, ch
xor al, ch
mov byte [esp + 0x15], ah
mov cl, 7
mov byte [esp + 0x11], al
mov dl, 4
lea eax, [esp + 0x11]
push 0
xor cl, ch
xor dl, ch
xor bl, ch
mov byte [esp + 0x16], cl
push eax
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], bl
call dword [0x101c1d88]
mov edi, eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xff30ffff
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x464
push 1
call esi
push eax
push 0
call esi
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [0x101c1e28], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x101c1e96], 0
jne 0x10006110
cmp dword [0x101c1db0], 1
jne 0x10006156
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
mov ecx, dword [0x101c1dbc]
add ecx, 0x3e8
test edx, edx
jb 0x10006156
ja 0x1000612e
cmp eax, ecx
jbe 0x10006156
call esi
mov dword [0x101c1dbc], eax
mov eax, dword [0x101c1db0]
test eax, eax
jne 0x1000615d
mov dword [0x101c1db0], 1
xor cl, cl
push 0
push 0
call fcn.10005d10
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10006156
mov ch, 0x45
mov byte [esp + 0x16], 0
mov bl, 0x35
mov dword [0x101c1db0], 0
mov ah, bl
mov byte [esp + 0x10], ch
mov al, 0x15
mov byte [esp + 0x16], 0
xor al, ch
xor ah, ch
mov cl, 7
mov byte [esp + 0x11], al
mov dl, 4
mov byte [esp + 0x15], ah
push 0
lea eax, [esp + 0x15]
xor cl, ch
xor dl, ch
mov byte [esp + 0x16], cl
xor bl, ch
mov byte [esp + 0x17], dl
push eax
mov byte [esp + 0x1c], bl
call dword [0x101c1d88]
mov edi, eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xff30ffff
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x464
push 1
call esi
push eax
push 0
call esi
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101c3108], 1
jne 0x10006156
cmp byte [0x101c30e9], 0
jne 0x10006236
push 0
push 0
mov cl, 1
mov byte [0x101c30e9], 1
call fcn.10005d10
mov byte [0x1006a4c5], 1
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x101c1d43], 0
je 0x10006156
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x101c1d94]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10006156
call esi
cmp byte [0x1006a4c5], 1
mov dword [0x101c1d94], eax
jne 0x100062a0
mov byte [0x1006a4c5], 0
xor cl, cl
cmp dword [0x101c305c], 0
je 0x1000614a
push dword [0x101c30b4]
push dword [0x101c30d4]
call fcn.10005d10
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x1006a4c5], 1
mov cl, 1
jmp 0x10006278