Function at 0x42b007
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push 0x2615
mov edi, str.MAIN_DBG:_d_r_n
mov ebp, ecx
push edi
mov esi, 0x4db0e0
push esi
mov dword [esp + 0x24], ebp
call fcn.00410fbb
add esp, 0xc
xor ebx, ebx
test byte [0x4de003], 0x20
je 0x42b052
push ebx
push ebx
push 0x44a
push dword [0x4d92ec]
call fcn.004123cd
pop ecx
push eax
call dword [sym.imp.user32.dll_SendMessageW]
push 0x261b
push edi
push esi
call fcn.00410fbb
add esp, 0xc
push ebx
push ebx
push 0x44a
push dword [0x4daf9c]
call dword [sym.imp.user32.dll_SendMessageW]
push 0x261d
push edi
push esi
call fcn.00410fbb
add esp, 0xc
cmp byte [0x4de001], bl
je 0x42b09f
cmp byte [0x4de002], bl
jne 0x42b09f
mov byte [0x4de002], 1
call fcn.0042115c
push 0x261f
push edi
push esi
call fcn.00410fbb
add esp, 0xc
mov eax, dword [0x4db0b8]
cmp eax, ebx
je 0x42b0bc
cmp word [eax], bx
jne 0x42b122
push ebx
mov ecx, ebp
call fcn.004187da
push dword [0x4db0b8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 0x2623
push str.MAIN_DBG:_d__u_MyShell__s__r_n
push esi
call fcn.00410fbb
mov eax, dword [0x4db0b8]
add esp, 0x14
cmp eax, ebx
je 0x42b0f2
cmp word [eax], bx
jne 0x42b0fd
push ebx
push ebx
push 0x64
mov ecx, ebp
call fcn.00415f6a
cmp byte [0x4daf8c], bl
je 0x42b0ae
cmp byte [0x4db8f0], bl
jne 0x42b0ae
push ebx
push ebx
push 0x44b
push dword [0x4daf9c]
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x42b0ae
push 0x2629
push edi
push esi
call fcn.00410fbb
mov ebp, dword [sym.imp.KERNEL32.DLL_SleepEx]
add esp, 0xc
push 1
push 0xa
call ebp
call fcn.00418fba
cmp byte [0x4de001], bl
je 0x42b15e
cmp byte [0x4de002], bl
jne 0x42b15e
mov byte [0x4de002], 1
call fcn.0042115c
push dword [0x4db0b8]
lea ecx, [esp + 0x18]
call fcn.0044df7a
push dword [esp + 0x14]
call fcn.00421175
mov dword [esp + 0x28], eax
call fcn.00418f89
push dword [esp + 0x28]
call fcn.00410e37
pop ecx
pop ecx
push 1
push 0xa
mov dword [esp + 0x2c], eax
call ebp
mov eax, dword [esp + 0x14]
cmp word [eax], bx
mov byte [esp + 0x13], 2
je 0x42b472
mov ebp, 0x4bfa2c
push 0x2644
push edi
push esi
call fcn.00410fbb
add esp, 0xc
call fcn.00418a4d
test eax, eax
jne 0x42b443
push 0x2646
push edi
push esi
call fcn.00410fbb
add esp, 0xc
cmp byte [0x4daf8c], bl
je 0x42b1f9
cmp byte [0x4db8f0], bl
jne 0x42b1f9
push ebx
push ebx
push 0x44b
push dword [0x4daf9c]
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
cmp word [eax], bx
je 0x42b443
push 0x2649
push edi
push esi
call fcn.00410fbb
push dword [esp + 0x30]
call fcn.0040fbff
push 8
push eax
push str.Explorer
mov dword [esp + 0x3c], eax
call fcn.0043f884
add esp, 0x1c
test al, al
je 0x42b24c
mov ecx, dword [esp + 0x20]
mov ax, word [ecx + 0x10]
cmp ax, 0x2e
je 0x42b246
cmp ax, bx
jne 0x42b24c
mov dword [esp + 0x20], ecx
jmp 0x42b250
mov dword [esp + 0x20], ebx
push 0x264b
push edi
push esi
call fcn.00410fbb
add esp, 0xc
test byte [0x4de003], 0x80
jne 0x42b443
cmp dword [esp + 0x20], ebx
je 0x42b28a
push ebx
push ebx
push ebx
push ebx
push dword [esp + 0x30]
call fcn.00417f81
add esp, 0x14
test eax, eax
jne 0x42b443
call fcn.0041225f
push 0x264e
push edi
push esi
call fcn.00410fbb
add esp, 0xc
push ebx
push ebx
push 0x44a
push dword [0x4daf9c]
call dword [sym.imp.user32.dll_SendMessageW]
push 0x2650
push edi
push esi
call fcn.00410fbb
push ebp
push ebp
call sym.PECMD.exe_LoadEnvi
add esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], eax
call fcn.0044df7a
push dword [esp + 0x1c]
call fcn.0041234d
mov dword [esp], 0x2657
push edi
push esi
mov dword [esp + 0x2c], eax
call fcn.00410fbb
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 0x2658
push str.MAIN_DBG:_d__u_MyShell__s__r_n
push esi
call fcn.00410fbb
add esp, 0x14
cmp byte [esp + 0x13], 2
mov eax, 0x4c4268
jl 0x42b32b
mov eax, 0x4c37c0
push eax
push str.BeforeStart
call fcn.0042af22
cmp dword [esp + 0x28], ebx
mov al, byte [esp + 0x1b]
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
push ebx
push ebx
mov byte [0x4db02c], al
push ebx
je 0x42b359
push dword [esp + 0x28]
call fcn.00433da9
jmp 0x42b372
push 7
lea eax, [esp + 0x30]
push eax
push ecx
push dword [esp + 0x34]
mov dword [esp + 0x3c], 0x5e
call fcn.0040a660
push 0x4c4268
push str.AfterTerm
mov byte [0x4db02c], bl
call fcn.0042af22
cmp byte [esp + 0x1b], 1
pop ecx
pop ecx
jle 0x42b394
dec byte [esp + 0x13]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esp + 0x28]
cmp eax, 0x7d0
jae 0x42b3cf
push ebx
push ebx
push 0x1f4
jmp 0x42b3c6
mov cx, word [eax]
cmp cx, bx
je 0x42b435
cmp cx, 0x2a
jne 0x42b3e4
cmp word [eax + 2], bx
jne 0x42b3e4
push ebx
push ebx
push 0x64
mov ecx, dword [esp + 0x24]
call fcn.00415f6a
mov ecx, dword [esp + 0x18]
push ebx
call fcn.004187da
mov eax, dword [0x4db0b8]
cmp eax, ebx
jne 0x42b3ae
jmp 0x42b435
push eax
lea ecx, [esp + 0x18]
call fcn.0044dfe2
push dword [esp + 0x14]
push 0x2666
push str.MAIN_DBG:_d_MyShell__s__r_n
push esi
call fcn.00410fbb
push dword [esp + 0x24]
call fcn.00421175
mov dword [esp + 0x3c], eax
call fcn.00418f89
push dword [esp + 0x3c]
call fcn.00410e37
push eax
push 0x266a
push str.MAIN_DBG:_d_ShellName__s__r_n
push esi
mov dword [esp + 0x4c], eax
call fcn.00410fbb
add esp, 0x28
lea ecx, [esp + 0x1c]
call fcn.0043e48d
jmp 0x42b1ab
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push 0x1f4
call fcn.00415f6a
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
call fcn.004187da
push dword [0x4db0b8]
lea ecx, [esp + 0x18]
call fcn.0044dfe2
jmp 0x42b1ab
lea ecx, [esp + 0x14]
call fcn.0043e48d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4