Function at 0x421653
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4afb60]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x421682
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4afb60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4afb60], ebx
push str.shell
push 0x4aff28
call fcn.0040f3c3
push ebx
call fcn.0040dc96
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov cx, word [eax]
add esp, 0xc
cmp cx, 0x2d
mov dword [ebp - 8], ebx
mov dl, 0x2a
jne 0x4216b0
mov dl, cl
movsx esi, dl
movzx ecx, cx
cmp esi, ecx
jne 0x421705
movzx ecx, word [eax + 2]
cmp esi, ecx
jne 0x421705
push 2
add eax, 4
push eax
push 0x49b3d8
call fcn.00432c59
add esp, 0xc
test al, al
je 0x421705
add dword [ebp - 4], 8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.004047e3
mov eax, dword [ebp - 4]
pop ecx
mov word [eax], bx
add dword [ebp - 4], 2
lea ecx, [ebp - 4]
call fcn.0040c032
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp esi, ecx
jne 0x42175b
movzx ecx, word [eax + 2]
cmp esi, ecx
jne 0x42175b
add eax, 4
xor edi, edi
mov dword [ebp - 4], eax
inc edi
push edi
lea eax, [ebp - 4]
push eax
push 0x49b3d4
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x421753
add dword [ebp - 4], 4
push edi
lea eax, [ebp - 4]
push eax
push 0x49a49c
call fcn.00438eee
add esp, 0xc
test al, al
je 0x421793
push 2
pop edi
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
jmp 0x4217a6
push 5
lea eax, [ebp + 8]
push eax
push str._user
call fcn.00438eee
add esp, 0xc
test al, al
je 0x421777
xor edi, edi
inc edi
jmp 0x4217a6
push 4
lea eax, [ebp + 8]
push eax
push str._sys
call fcn.00438eee
add esp, 0xc
test al, al
je 0x421793
push 2
pop edi
jmp 0x4217a6
push str.UCallBackhWnd
call fcn.0040ebf2
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x4217cb
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x2c
lea eax, [ebp - 8]
call fcn.00410b80
mov eax, dword [ebp - 8]
cmp word [eax], bx
pop ecx
je 0x4217cb
mov word [eax], bx
inc eax
inc eax
cmp edi, ebx
jne 0x4217db
cmp word [eax], bx
je 0x4217db
push eax
call fcn.00420f2f
pop ecx
push str.Shell.x
mov esi, str.SOFTWAREPELOGON
push esi
mov ebx, 0x80000002
push ebx
call dword [0x4b0070]
push 0
push 0
call fcn.0040eb20
pop ecx
cmp edi, 1
pop ecx
mov edi, str.UShell
je 0x42180d
mov edi, dword [0x4aff10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 8]
push 1
push edi
push esi
push ebx
call dword [0x4b006c]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x18], eax
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push str.SysShel.ack
push str.SOFTWAREPELOGONRAMDATA
xor edi, edi
push ebx
mov dword [ebp - 0xc], edi
call dword [0x4afd70]
test eax, eax
jne 0x42186a
cmp dword [ebp - 0xc], edi
jne 0x42192b
mov dword [ebp - 8], edi
call esi
mov edi, eax
add edi, 5
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x421914
cmp byte [0x4ae290], 0
jle 0x421914
test ecx, ecx
jbe 0x421902
cmp ecx, 0x7d0
jbe 0x4218a2
mov ecx, 0x3e8
jmp 0x4218aa
cmp ecx, 0x64
jbe 0x4218aa
push 0x64
pop ecx
push 0x4bf
push ecx
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x421902
cmp dword [ebp - 8], 0
jg 0x4218d0
call esi
mov ecx, edi
sub ecx, eax
test ecx, ecx
jle 0x42190b
push 3
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42190b
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], 0
jle 0x421902
dec dword [ebp - 8]
cmp byte [0x4ae290], 0
jg 0x4218c0
and dword [ebp - 8], 0
jmp 0x421874
call esi
sub eax, dword [ebp - 0x18]
cmp eax, 0x1770
jbe 0x421832
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov dword [ebp - 8], edi
call esi
mov ebx, eax
add ebx, 0x96
call esi
mov ecx, ebx
sub ecx, eax
cmp ecx, edi
jle 0x421924
cmp byte [0x4ae290], 0
jle 0x421924
cmp ecx, edi
jbe 0x4219b8
cmp ecx, 0x7d0
jbe 0x42195e
mov ecx, 0x3e8
jmp 0x421966
cmp ecx, 0x64
jbe 0x421966
push 0x64
pop ecx
push 0x4bf
push ecx
push edi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x4219b8
cmp dword [ebp - 8], edi
jg 0x421989
call esi
mov ecx, ebx
sub ecx, eax
test ecx, ecx
jle 0x4219c1
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4219c1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], edi
jle 0x4219b8
dec dword [ebp - 8]
cmp byte [0x4ae290], 0
jg 0x42197a
mov dword [ebp - 8], edi
jmp 0x421938