Function at 0x406ef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 0x18], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
mov edx, eax
mov eax, dword [ebp - 0x1c]
add eax, edx
shl eax, 2
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateBitmap]
call eax
sub esp, 0x14
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
call eax
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetBitmapBits]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x31], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edx, dword [ebp - 0x18]
sub eax, edx
cmp eax, 0xa
seta al
test al, al
je 0x407099
call sym._rand
mov ecx, eax
mov edx, 0x80808081
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 7
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov edx, eax
shl edx, 8
sub edx, eax
mov eax, ecx
sub eax, edx
mov byte [ebp - 0x31], al
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14], eax
jge 0x407144
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x20]
mov eax, edx
test eax, eax
jne 0x4070eb
call sym._rand
mov ecx, eax
mov edx, 0x94f2095
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x6e
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x4070eb
mov eax, 1
jmp 0x4070f0
mov eax, 0
test al, al
je 0x407126
call sym._rand
mov ecx, eax
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov edx, ecx
sar edx, 0x1f
sub eax, edx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x10]
add edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov byte [eax], 5
add dword [ebp - 0x14], 1
jmp 0x4070a0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
shl eax, 2
mov edx, eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SetBitmapBits]
call eax
sub esp, 0xc
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0xc]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0xc], edx
jmp 0x406f68