Function at 0x403672
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 0x28], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
mov edx, eax
mov eax, dword [ebp - 0x2c]
add eax, edx
shl eax, 2
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call eax
sub esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateBitmap]
call eax
sub esp, 0x14
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
call eax
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
lea edx, [eax*4]
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetBitmapBits]
call eax
sub esp, 0xc
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x1d], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edx, dword [ebp - 0x28]
sub eax, edx
cmp eax, 0xea60
seta al
test al, al
je 0x4037fd
call sym._rand
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
cmp dword [ebp - 0x24], eax
jge 0x4038f5
mov eax, dword [ebp - 0x24]
cdq
idiv dword [ebp - 0x30]
mov eax, edx
test eax, eax
jne 0x40384f
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x40384f
mov eax, 1
jmp 0x403854
mov eax, 0
test al, al
je 0x403884
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
imul edx, eax, 0x32
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0x34]
add eax, edx
add eax, 0xfc
movzx ebx, byte [eax]
mov eax, dword [ebp - 0x24]
lea edx, [eax*4]
mov eax, dword [ebp - 0x34]
lea esi, [edx + eax]
mov ecx, dword [ebp - 0x24]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov edi, ecx
sar edi, 0x1f
mov eax, edx
sub eax, edi
mov edx, eax
add edx, edx
add edx, eax
mov eax, ecx
sub eax, edx
add eax, esi
movzx eax, byte [eax]
xor al, byte [ebp - 0x1d]
mov edx, eax
mov eax, dword [ebp - 0x24]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x34]
add eax, ecx
add eax, 0xfc
add edx, ebx
mov byte [eax], dl
add dword [ebp - 0x24], 1
jmp 0x403804
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x30]
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SetBitmapBits]
call eax
sub esp, 0xc
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
add dword [ebp - 0x1c], 1
mov ecx, dword [ebp - 0x1c]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x1c], edx
jmp 0x4036ed