Function at 0x537a6c
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd30
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x21c]
xor ecx, ecx
mov edx, 0x208
call fcn.0040372c
lea eax, [ebp - 0x21c]
mov ecx, 0x104
mov edx, ebx
call fcn.0040dc80
lea eax, [ebp - 0x260]
xor ecx, ecx
mov edx, 0x44
call fcn.0040372c
lea eax, [ebp - 0x270]
xor ecx, ecx
mov edx, 0x10
call fcn.0040372c
mov dword [ebp - 0x260], 0x44
mov dword [ebp - 0x234], 1
mov word [ebp - 0x230], si
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x537dfc
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x537d8d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
call sub.kernel32.dll_CreateJobObjectW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x537b2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404e5c
jmp 0x537e03
cmp dword [ebp + 8], 0
je 0x537b3a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov dword [ebp - 0x290], 0x800
push 0x30
lea eax, [ebp - 0x2a0]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetInformationJobObject
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x1000004
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x537b99
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404e5c
jmp 0x537e03
mov eax, dword [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_AssignProcessToJobObject
test eax, eax
jne 0x537bbf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404e5c
jmp 0x537e03
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x537be2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404e5c
jmp 0x537e03
mov eax, dword [0x547674]
cmp dword [eax], 6
jl 0x537c23
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
call fcn.0046bf70
mov ecx, eax
mov dl, 1
mov eax, dword [0x5234d8]
call fcn.00523550
mov edi, eax
mov dl, 1
mov eax, edi
call fcn.00523688
mov dl, 2
mov eax, edi
call fcn.005236ac
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00523718
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4a4]
mov eax, dword [ebp - 4]
mov dword [edx + 0x270], eax
mov edx, dword [ebp + 0xc]
mov esi, eax
dec esi
test esi, esi
jl 0x537d5f
inc esi
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
mov eax, dword [eax + 0x270]
mov edx, ebx
call fcn.00523e48
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
fild dword [eax + 0x270]
fmulp st(1)
call fcn.00403530
mov edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
call fcn.0052fc38
mov eax, dword [0x547674]
cmp dword [eax], 6
jl 0x537cc1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
mov edx, dword [eax + 0x278]
mov eax, edi
call fcn.005236dc
mov eax, dword [0x5479b4]
mov eax, dword [eax]
call fcn.0048558c
cmp ebx, dword [ebp - 4]
jbe 0x537d2e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
mov edx, edi
call fcn.00534dbc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
xor edx, edx
call fcn.0052fc38
mov eax, dword [0x5479b4]
mov eax, dword [eax]
call fcn.0048558c
mov dword [ebp - 8], 0x5b4
mov eax, dword [0x547674]
cmp dword [eax], 6
jl 0x537d1c
mov eax, edi
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404e5c
jmp 0x537e03
push 0
push 0x30
lea eax, [ebp - 0x2d0]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryInformationJobObject
test eax, eax
je 0x537d5f
cmp dword [ebp - 0x2a8], 0
je 0x537d5f
push 0xa
call sub.kernel32.dll_Sleep_2
dec esi
jne 0x537c4f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4a4]
mov edx, edi
call fcn.00534dbc
mov eax, dword [0x547674]
cmp dword [eax], 6
jl 0x537d83
mov eax, edi
call fcn.00403f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537dab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537e03
cmp dword [ebp - 8], 0
je 0x537dc6
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x537dd6
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x537de6
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x537dfb
cmp dword [ebp + 8], 0
jne 0x537dfb
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4