Function at 0x401a4e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp - 0x10], eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp - 0x14], eax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov dword [rbp - 0x18], eax
mov eax, dword [rbp - 0x14]
lea edx, [rax*4]
mov eax, dword [rbp - 0x18]
add eax, 1
imul eax, edx
cdqe
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0xc], 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_CreateCompatibleDC]
call rax
mov qword [rbp - 0x30], rax
mov edx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
mov rcx, qword [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8d, 1
mov ecx, eax
mov rax, qword [sym.imp.GDI32.dll_CreateBitmap]
call rax
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SelectObject]
call rax
mov ecx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x30]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp - 0x28]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp - 0x18]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov eax, dword [rbp - 0x18]
shl eax, 2
imul eax, dword [rbp - 0x14]
mov edx, eax
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_GetBitmapBits]
call rax
mov dword [rbp - 8], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
sub eax, dword [rbp - 0x10]
cmp eax, 0xa
seta al
test al, al
je 0x401bba
call sym.rand
mov dword [rbp - 4], 0
jmp 0x401c79
mov eax, dword [rbp - 4]
cdq
idiv dword [rbp - 0x18]
mov eax, edx
test eax, eax
jne 0x401c01
call sym.rand
mov ecx, eax
mov edx, 0x94f2095
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x6e
sub ecx, eax
mov eax, ecx
test eax, eax
jne 0x401c01
mov eax, 1
jmp 0x401c06
mov eax, 0
test al, al
je 0x401c3c
call sym.rand
mov ecx, eax
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov dword [rbp - 8], eax
mov edx, dword [rbp - 8]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
sub ecx, eax
mov eax, ecx
mov dword [rbp - 8], eax
mov eax, dword [rbp - 4]
shl eax, 2
movsxd rdx, eax
mov eax, dword [rbp - 8]
cdqe
add rdx, rax
mov rax, qword [rbp - 0x20]
add rax, rdx
mov edx, dword [rbp - 4]
shl edx, 2
movsxd rcx, edx
mov edx, dword [rbp - 8]
movsxd rdx, edx
add rcx, rdx
mov rdx, qword [rbp - 0x20]
add rdx, rcx
movzx edx, byte [rdx]
sub edx, 5
mov byte [rax], dl
add dword [rbp - 4], 1
mov eax, dword [rbp - 0x18]
imul eax, dword [rbp - 0x14]
cmp eax, dword [rbp - 4]
jg 0x401bc6
mov eax, dword [rbp - 0x18]
shl eax, 2
imul eax, dword [rbp - 0x14]
mov ecx, eax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov r8, rdx
mov edx, ecx
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_SetBitmapBits]
call rax
mov ecx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x28]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rdx, qword [rbp - 0x30]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp - 0x18]
mov dword [rsp + 0x20], edx
mov r9d, ecx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_BitBlt]
call rax
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.GDI32.dll_DeleteObject]
call rax
mov eax, dword [rbp - 0xc]
lea edx, [rax + 1]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
add edx, eax
and edx, 1
sub edx, eax
mov eax, edx
mov dword [rbp - 0xc], eax
jmp 0x401ac8