Function at 0x43bf00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esi + 0x1000]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push ebx
mov dword [esp + 0x28], 0
mov dword [esp + 0x3c], ebx
call ebp
push ebx
mov edi, eax
call ebp
push ebx
mov dword [esp + 0x10], eax
call ebp
mov dword [esp + 0x1c], eax
mov dword [esi + 0x1080], ebx
mov dword [esp + 0x18], 0
nop
mov eax, dword [esi + 0x10a8]
test eax, eax
jne 0x43bf40
mov eax, dword [esi + 0x109c]
test eax, eax
mov dword [esi + 0x10a8], 1
je 0x43bf65
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esi + 0x10a4]
mov edx, dword [esi + 0x10a0]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov dword [esi + 0x109c], eax
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [esi + 0x10a4]
mov edx, dword [esi + 0x10a0]
push ecx
push edx
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov eax, dword [esp + 0x20]
push eax
call ebp
mov ecx, dword [esi + 0x11c0]
mov edx, dword [esi + 0x11bc]
mov eax, dword [esi + 0x10a4]
push 0xcc0020
push ecx
mov ecx, dword [esi + 0x10a0]
push edx
mov edx, dword [esp + 0x18]
push ebx
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call ebp
mov dword [esi + 0x10a8], 0
mov edx, dword [esi + 0x1098]
cmp edx, 1
mov dword [esi + 0x1060], 4
je 0x43c456
nop
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], eax
mov edi, edi
mov eax, dword [esi + 0x10a8]
test eax, eax
jne 0x43c020
mov ecx, dword [esi + 0x109c]
mov edx, dword [esp + 0xc]
push ecx
push edx
mov dword [esi + 0x10a8], 1
call ebp
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x1060]
cmp eax, 8
je 0x43c056
cmp eax, 0xc
jne 0x43c0ae
mov eax, dword [esp + 0x18]
push eax
push edi
call ebp
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
push 0xcc0020
push 0
push 0
push edi
push ecx
mov ecx, dword [esi + 0x1034]
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x1030]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x18], 0
cmp dword [esp + 0x24], 0
mov dword [esi + 0x1060], 0
jne 0x43c384
mov eax, esi
call fcn.0043bb70
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x1060]
cmp eax, 8
je 0x43c0de
cmp eax, 0xc
jne 0x43c138
mov edx, dword [esi + 0x102c]
mov eax, dword [esi + 0x1028]
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [esp + 0x20], eax
call ebp
mov ecx, dword [esi + 0x1030]
mov edx, dword [esi + 0x1034]
push 0xcc0020
push ecx
mov ecx, dword [esi + 0x102c]
push edx
mov edx, dword [esi + 0x1028]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push eax
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push ecx
push edi
call ebp
cmp dword [esi + 0x1064], 0
mov dword [esp + 0x14], eax
je 0x43c2e8
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esi + 0x102c]
push 0
push 1
push 1
mov ebx, eax
mov eax, dword [esi + 0x1028]
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
push 0
push 1
push 1
push ecx
push edx
mov dword [esp + 0x40], eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
call ebp
mov edx, dword [esp + 0x30]
push edx
push ebx
mov dword [esp + 0x34], eax
call ebp
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x107c]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
push 0xcc0020
push 0
push 0
push edi
push ecx
push edx
push 0
push 0
push ebx
mov dword [esp + 0x54], eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x30]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
mov eax, dword [esp + 0x10]
push 0x330008
push 0
push 0
push ebx
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
mov eax, dword [esi + 0x1030]
push 0x8800c6
push 0
push 0
push ebx
push ecx
mov ecx, dword [esi + 0x1034]
push edx
push eax
push ecx
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x102c]
mov edx, dword [esi + 0x1028]
push 0x8800c6
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x102c]
mov ecx, dword [esi + 0x1028]
mov edx, dword [esi + 0x1030]
push 0xee0086
push 0
push 0
push edi
push eax
mov eax, dword [esi + 0x1034]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x34]
push ecx
push ebx
call ebp
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [esp + 0x38]
jmp 0x43c319
mov eax, dword [esi + 0x102c]
mov ecx, dword [esi + 0x1028]
mov edx, dword [esi + 0x1030]
push 0xcc0020
push 0
push 0
push edi
push eax
mov eax, dword [esi + 0x1034]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x14]
push edx
push edi
call ebp
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x10a4]
mov eax, dword [esi + 0x10a0]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi + 0x11c0]
push edx
mov edx, dword [esi + 0x11bc]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10a4]
mov edx, dword [esi + 0x10a0]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push 0
push 0
push eax
jmp 0x43c3af
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x10a4]
mov eax, dword [esi + 0x10a0]
push 0xcc0020
push 0
push 0
push ecx
mov ecx, dword [esi + 0x11c0]
push edx
mov edx, dword [esi + 0x11bc]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call ebp
mov eax, dword [esi + 0x106c]
test eax, eax
mov dword [esi + 0x10a8], 0
je 0x43c3e0
lea ecx, [eax + eax*4]
add ecx, ecx
mov dword [esp + 0x20], ecx
jmp 0x43c3ec
mov edx, dword [esi + 0x1078]
mov dword [esp + 0x20], edx
mov ecx, edx
mov eax, dword [esi + 0x1098]
cmp eax, 1
je 0x43c42d
jmp 0x43c404
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x3c]
cmp ecx, eax
jbe 0x43c42d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1098]
cmp ecx, 1
mov dword [esp + 0x28], eax
jne 0x43c400
movzx edx, byte [esi + 0x1004]
mov eax, dword [esi + 0x1098]
cmp eax, 1
mov dword [esp + 0x24], edx
jne 0x43c010
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43c456
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
pop edi
pop ebp
mov dword [esi + 0x1098], 2
mov eax, 1
pop ebx
add esp, 0x34
ret