Function at 0x9650b8
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.00904afc
xor eax, eax
push ebp
push 0x965550
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
push edx
dec edx
inc edx
xor edx, 0x11e
mov edx, 0x15
xchg edx, edx
inc edx
pop edx
mov dl, 1
mov eax, dword [0x912608]
call fcn.00903804
mov dword [ebp - 0x10], eax
push eax
push edi
mov eax, 0x15a
add edi, 0x60
dec edi
xor eax, 0x66
pop edi
pop eax
push 1
call sub.gdi32.dll_GetStretchBltMode
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 4]
push esi
push edx
xchg esi, edx
add esi, 0x130
xor edx, 0x187
dec edx
or esi, 0x131
add esi, 0x9e
mov esi, 0x51
add esi, 0x4c
mov esi, 0x105
nop
nop
nop
nop
and edx, 0x19a
pop edx
pop esi
push 1
call sub.kernel32.dll_CancelWaitableTimer
push esi
push ecx
and ecx, 0x99
and esi, 0x108
xchg esi, esi
or esi, 0x166
xor esi, 0x13a
xor ecx, 0xc2
inc ecx
dec ecx
or esi, 0x9a
mov esi, 0x30
push esi
pop esi
pop ecx
pop esi
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.009162a8
call sub.kernel32.dll_GetLastError
push ebx
push ebx
pop ebx
mov ebx, 0x168
mov ebx, 0xc4
inc ebx
push ebx
pop ebx
xchg ebx, ebx
nop
nop
nop
pop ebx
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.009162a8
push 1
call sub.kernel32.dll_CancelWaitableTimer
push esi
push ecx
and ecx, 0x99
and esi, 0x108
xchg esi, esi
or esi, 0x166
xor esi, 0x13a
xor ecx, 0xc2
inc ecx
dec ecx
or esi, 0x9a
mov esi, 0x30
push esi
pop esi
pop ecx
pop esi
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x95c72c]
call fcn.0095cab8
mov dword [ebp - 0x18], eax
push esi
inc esi
inc esi
inc esi
nop
nop
nop
nop
nop
inc esi
pop esi
push 1
call sub.gdi32.dll_GetStretchBltMode
xor eax, eax
push ebp
push 0x96541e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKBCodePage
push ebx
add ebx, 0x172
mov ebx, 0x13a
nop
nop
xor ebx, 0xd6
inc ebx
and ebx, 0x167
pop ebx
lea edx, [ebp - 0x42c]
mov ecx, 0x400
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x965395
push 1
call sub.user32.dll_GetListBoxInfo
push edx
push edi
and edx, 0x6a
sub edx, 0x74
push edx
pop edx
add edi, 0x122
or edi, 0x28
inc edx
mov edx, 0x45
and edx, 0x10b
xchg edx, edi
push edx
pop edx
xor edi, 0xb9
and edi, 0xd4
dec edi
push edx
pop edx
and edx, 0x168
pop edi
pop edx
lea edx, [ebp - 0x42c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.009164ec
push ecx
push ecx
pop ecx
xchg ecx, ecx
nop
nop
nop
nop
inc ecx
nop
nop
nop
xor ecx, 0x13e
and ecx, 0x24
add ecx, 0x139
or ecx, 0x196
sub ecx, 0x64
xchg ecx, ecx
pop ecx
call sub.user32.dll_GetKBCodePage
push ebx
add ebx, 0x172
mov ebx, 0x13a
nop
nop
xor ebx, 0xd6
inc ebx
and ebx, 0x167
pop ebx
lea edx, [ebp - 0x42c]
mov ecx, 0x400
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
push 1
call sub.user32.dll_GetListBoxInfo
push edx
push edi
and edx, 0x6a
sub edx, 0x74
push edx
pop edx
add edi, 0x122
or edi, 0x28
inc edx
mov edx, 0x45
and edx, 0x10b
xchg edx, edi
push edx
pop edx
xor edi, 0xb9
and edi, 0xd4
dec edi
push edx
pop edx
and edx, 0x168
pop edi
pop edx
call sub.kernel32.dll_GetTickCount
push edx
dec edx
inc edx
xor edx, 0x11e
mov edx, 0x15
xchg edx, edx
inc edx
pop edx
cmp dword [ebp - 0x1c], 0
jg 0x965282
push 1
call sub.user32.dll_GetListBoxInfo
push edx
push edi
and edx, 0x6a
sub edx, 0x74
push edx
pop edx
add edi, 0x122
or edi, 0x28
inc edx
mov edx, 0x45
and edx, 0x10b
xchg edx, edi
push edx
pop edx
xor edi, 0xb9
and edi, 0xd4
dec edi
push edx
pop edx
and edx, 0x168
pop edi
pop edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x965425
call sub.kernel32.dll_GetLastError
push ebx
push ebx
pop ebx
mov ebx, 0x168
mov ebx, 0xc4
inc ebx
push ebx
pop ebx
xchg ebx, ebx
nop
nop
nop
pop ebx
mov eax, dword [ebp - 0x18]
call fcn.00903834
call sub.kernel32.dll_GetTickCount
push edx
dec edx
inc edx
xor edx, 0x11e
mov edx, 0x15
xchg edx, edx
inc edx
pop edx
ret