Function at 0x42fd10
Capabilities:
Check for time delay via gettickcount
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f420
push 0x435df4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [0x7eec2f0]
cmp eax, edi
jbe 0x42fd53
add eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x42fe15
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x43f3c0
push eax
call dword [ecx]
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push ecx
push 0x43f3c0
push esi
call dword [eax]
cmp dword [ebp - 0x1c], edi
je 0x42fe15
mov edx, dword [ebp - 0x24]
cmp edx, edi
je 0x42fe15
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
mov ecx, 0x1f
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
mov eax, 0x7c
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x11c], eax
mov eax, dword [edx]
lea ecx, [ebp - 0xa0]
push ecx
push edx
call dword [eax + 0x58]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
lea ecx, [ebp - 0x11c]
push ecx
push eax
call dword [edx + 0x58]
mov eax, dword [ebp - 0x38]
test ah, 2
je 0x42fe15
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x124], ecx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov edi, dword [ebp + 0x14]
jne 0x42fe5d
test edi, edi
jne 0x42fe40
cmp dword [ebp - 0x94], eax
jne 0x42fe15
cmp eax, ecx
je 0x42fe90
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42fe22
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42fe2f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
sub edx, dword [edi]
cmp dword [ebp - 0x94], edx
jne 0x42fe15
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
cmp dword [ebp - 0x98], eax
jne 0x42fe15
jmp 0x42fe90
test edi, edi
jne 0x42fe72
mov edx, dword [ebx + 8]
sub edx, dword [ebx]
cmp edx, eax
jne 0x42fe15
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
jmp 0x42fe11
mov ecx, dword [ebx + 8]
sub ecx, dword [ebx]
mov edx, dword [edi + 8]
sub edx, dword [edi]
cmp ecx, edx
jne 0x42fe15
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 4]
cmp eax, ecx
jne 0x42fe15
test byte [ebp - 0xd0], 0x40
je 0x42fe15
mov eax, dword [ebp - 0xc8]
cmp eax, 0x20
je 0x42feb1
cmp eax, 0x10
jne 0x42fe15
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x128], eax
xor esi, esi
mov dword [ebp - 0x130], esi
cmp esi, dword [0x7eec2f4]
jg 0x42fe15
test ebx, ebx
jne 0x42fedd
mov dword [ebp - 0x354], ebx
jmp 0x42fee5
mov edx, dword [ebx]
mov dword [ebp - 0x354], edx
test ebx, ebx
je 0x42feec
mov ebx, dword [ebx + 4]
test edi, edi
jne 0x42fef8
mov eax, dword [ebp - 0x134]
jmp 0x42fefd
mov eax, dword [edi + 8]
sub eax, dword [edi]
mov dword [ebp - 0x23c], eax
test edi, edi
jne 0x42ff15
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x244], ecx
jmp 0x42ff21
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x238], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x237]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
test esi, esi
jne 0x42ff62
mov edx, dword [ebp - 0x128]
push edx
push 7
call fcn.00433d10
add esp, 4
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x42ff94
mov eax, dword [esi*4 + 0x7ee82b8]
test eax, eax
je 0x4304cc
push esi
mov ecx, dword [ebp - 0x128]
push ecx
push 6
call fcn.00433d10
add esp, 4
push eax
lea edx, [ebp - 0x238]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x248], eax
test eax, eax
je 0x4304cc
push 0
push 0
push 0
push 6
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x240], esi
xor eax, eax
cmp esi, eax
jne 0x42ffe1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4304c6
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 4], eax
mov edi, dword [esi + 4]
mov dword [ebp - 0x138], edi
lea ecx, [ebp - 0x350]
push ecx
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
lea edx, [ebp - 0x384]
push edx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
call fcn.004235d0
add esp, 4
mov dword [ebp - 0x388], eax
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x430071
mov eax, dword [ebp - 0x37c]
cmp eax, dword [esi + 0xc]
jne 0x430045
mov ecx, dword [ebp - 0x378]
cmp ecx, dword [esi + 0x10]
je 0x430071
mov eax, dword [esi + 0x24]
test eax, eax
je 0x430058
mov dword [ebp - 0x38c], eax
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x24], 0
mov eax, dword [ebp - 0x37c]
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 0x378]
mov dword [esi + 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x430191
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x40c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x40c], 0x7c
mov dword [ebp - 0x408], 7
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x400], edx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x3a4], 0x840
mov eax, dword [0x7eecc2c]
test eax, eax
je 0x4300e0
mov eax, dword [ebp - 0xb4]
test ah, 0x40
je 0x4300e0
mov dword [ebp - 0x3a4], 0x4040
xor edi, edi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x390], edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x414]
push edx
push eax
call dword [ecx + 0x90]
test eax, eax
jl 0x430204
mov eax, dword [ebp - 0x414]
mov ecx, dword [eax]
lea edx, [ebp - 0x410]
push edx
push 0x43f370
push eax
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x414]
mov ecx, dword [eax]
push eax
jge 0x43014f
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42fe15
call dword [ecx + 8]
mov eax, dword [ebp - 0x410]
mov edx, dword [eax]
push edi
lea ecx, [ebp - 0x390]
push ecx
lea ecx, [ebp - 0x40c]
push ecx
push eax
call dword [edx + 0x18]
test eax, eax
mov eax, dword [ebp - 0x410]
jge 0x430182
mov edx, dword [eax]
push eax
call dword [edx + 8]
jmp 0x430204
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x390]
mov dword [esi + 0x24], edx
mov eax, dword [ebp - 0x354]
test eax, eax
jne 0x4301a1
mov eax, dword [ebp - 0x350]
test ebx, ebx
jne 0x4301ab
mov ebx, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x350]
mov dword [ebp - 0x370], eax
sub ebx, dword [ebp - 0x34c]
mov ecx, ebx
mov dword [ebp - 0x36c], ecx
mov edx, dword [ebp - 0x23c]
add eax, edx
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x244]
add ecx, eax
mov dword [ebp - 0x364], ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push 0
push 0x1000000
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp - 0x1c]
push edx
lea edx, [ebp - 0x370]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x43021d
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42fe15
mov byte [ebp - 0x348], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x347]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x130]
test eax, eax
jne 0x430264
mov ecx, dword [ebp - 0x128]
push ecx
push 5
call fcn.00433d00
add esp, 4
push eax
lea edx, [ebp - 0x348]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x430287
push eax
mov eax, dword [ebp - 0x128]
push eax
push 4
call fcn.00433d00
add esp, 4
push eax
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x348]
push edx
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x35c], eax
test eax, eax
je 0x430486
mov ebx, dword [esi + 0x24]
mov dword [ebp - 0x418], ebx
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x494]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x494], 0x7c
mov eax, dword [ebx]
push 0
push 1
lea ecx, [ebp - 0x494]
push ecx
push 0
push ebx
call dword [eax + 0x64]
test eax, eax
jne 0x430479
mov edx, dword [ebp - 0x470]
mov dword [ebp - 0x4a0], edx
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x4a4], eax
lea ecx, [esi + 0x28]
mov dword [ebp - 0x49c], ecx
mov eax, dword [esi + 0xc]
shl eax, 2
mov dword [ebp - 0x4a8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4ac], 0
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x43045b
cmp dword [ebp - 0x440], 0x10
jne 0x430401
xor eax, eax
mov dword [ebp - 0x4c0], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
jbe 0x430427
mov edx, dword [ebp - 0x4a0]
mov ax, word [edx + eax*2]
and eax, 0xffff
mov ecx, eax
shr ecx, 8
and ecx, 0xf8
mov ebx, eax
shr ebx, 3
and ebx, 0xfc
and eax, 0x1f
shl eax, 3
mov edi, eax
mov eax, ecx
xor edx, edx
mov esi, 0x1f
div esi
add ecx, eax
mov eax, ebx
xor edx, edx
mov esi, 0x3f
div esi
add ebx, eax
mov eax, edi
xor edx, edx
mov esi, 0x1f
div esi
add edi, eax
cmp ecx, 0xff
jbe 0x4303af
mov ecx, 0xff
cmp ebx, 0xff
jbe 0x4303bc
mov ebx, 0xff
cmp edi, 0xff
jbe 0x4303c9
mov edi, 0xff
xor edx, edx
mov dh, cl
mov dl, bl
shl edx, 8
and edi, 0xff
or edx, edi
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [ebp - 0x49c]
mov dword [ecx + eax*4], edx
inc eax
mov dword [ebp - 0x4c0], eax
mov esi, dword [ebp - 0x240]
cmp eax, dword [esi + 0xc]
jb 0x43034e
jmp 0x430427
mov ecx, dword [ebp - 0x4a8]
mov esi, dword [ebp - 0x4a0]
mov edi, dword [ebp - 0x49c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x4a4]
add dword [ebp - 0x4a0], eax
mov ecx, dword [ebp - 0x4a8]
add dword [ebp - 0x49c], ecx
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp eax, dword [esi + 0x10]
jb 0x43032e
mov ebx, dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebx]
push 0
push ebx
call dword [edx + 0x80]
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4304c6
mov esi, dword [ebp - 0x130]
inc esi
mov dword [ebp - 0x130], esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x42fec5