Function at 0x10005d30
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
push esi
push edi
mov esi, ecx
push 3
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDCEx]
push 0
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esi + 0x20]
mov ebx, eax
mov eax, dword [esi + 0x24]
xorps xmm0, xmm0
push 0
push 0
movups xmmword [esp + 0x30], xmm0
neg eax
mov dword [esp + 0x20], ebx
push 0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x30]
push 0
push eax
push 0
movups xmmword [esp + 0x50], xmm0
mov dword [esp + 0x3c], 0x28
movq qword [esp + 0x60], xmm0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], 0x200001
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, eax
push edi
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x50]
push eax
push 0x18
push edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
call edi
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x80]
push eax
push 0x18
push dword [esi + 0x10]
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x10005eb8
xor eax, eax
nop dword [eax]
imul eax, eax, 0xfa
xor edx, edx
div ecx
mov ecx, dword [esi]
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], eax
mov edi, dword [ecx]
lea ebx, [eax + 5]
mov dl, bl
not dl
movzx eax, dl
movzx edx, bl
cmove eax, edx
movzx eax, al
push eax
call dword [edi + 0x88]
mov ecx, esi
call fcn.10005990
mov edi, eax
lea eax, [esp + 0x68]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp + 0x10]
add ecx, 5
push ecx
push dword [esp + 0x80]
mov ecx, esi
push dword [esp + 0x9c]
push dword [esp + 0x20]
call fcn.10005a50
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x84]
mov ebx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push ebx
push dword [esi + 0x24]
push dword [esi + 0x20]
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x2c]
cmp eax, ecx
jb 0x10005e00
cmp dword [esi + 0xc], 0
mov ecx, dword [esi]
setne al
dec al
movzx eax, al
mov edx, dword [ecx]
push eax
call dword [edx + 0x88]
mov ecx, esi
call fcn.10005990
mov ecx, dword [esi]
mov edi, eax
mov edx, dword [ecx]
call dword [edx + 0x84]
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebx
push dword [esi + 0x24]
push dword [esi + 0x20]
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [esp + 0xc]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x20]
call edi
push 0
push 0
push 0x430
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret